CVE-2016-9137: Use After Free
Published Jan 4, 2017
·Updated
Use-after-free vulnerability in the CURLFile implementation in ext/curl/curlfile.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during wakeup processing.
Affected Software
13 affected components
PHP PHP<=5.6.26
PHP PHP=7.0.0
PHP PHP=7.0.1
PHP PHP=7.0.2
PHP PHP=7.0.3
PHP PHP=7.0.4
PHP PHP=7.0.5
PHP PHP=7.0.6
PHP PHP=7.0.7
PHP PHP=7.0.8
PHP PHP=7.0.9
PHP PHP=7.0.10
PHP PHP=7.0.11
Remediation
Event History
Jan 4, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-9137?
CVE-2016-9137 has a high severity rating as it can lead to denial of service or potentially other impacts.
2
How do I fix CVE-2016-9137?
To fix CVE-2016-9137, upgrade PHP to version 5.6.27 or 7.0.12 or later.
3
Which versions of PHP are affected by CVE-2016-9137?
CVE-2016-9137 affects PHP versions before 5.6.27 and all 7.x versions before 7.0.12.
4
What kind of attack does CVE-2016-9137 enable?
CVE-2016-9137 enables remote attackers to cause a denial of service through crafted serialized data.
5
Is CVE-2016-9137 a local or remote vulnerability?
CVE-2016-9137 is a remote vulnerability that can be exploited over a network.