CVE-2016-9138: Use After Free

Q: What is the severity of CVE-2016-9138?

CVE-2016-9138 has a moderate severity level due to its potential for causing denial of service.

Q: How do I fix CVE-2016-9138?

To fix CVE-2016-9138, upgrade PHP to version 5.6.28 or newer, or to any version in the 7.1 series or later.

Q: What versions of PHP are affected by CVE-2016-9138?

CVE-2016-9138 affects PHP versions up to 5.6.27 and from 7.0.0 up to 7.0.12.

Q: Can CVE-2016-9138 lead to remote code execution?

CVE-2016-9138 does not directly lead to remote code execution but may be exploited for denial of service and other unspecified impacts.

Q: What is the attack vector for CVE-2016-9138?

CVE-2016-9138 can be exploited by remote attackers through crafted serialized data during the __wakeup processing.

Published Jan 4, 2017

Updated

PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during wakeup processing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data, as demonstrated by Exception::toString with DateInterval::wakeup.

Affected Software

14 affected components

PHP PHP<=5.6.27

PHP PHP=7.0.0

PHP PHP=7.0.1

PHP PHP=7.0.2

PHP PHP=7.0.3

PHP PHP=7.0.4

PHP PHP=7.0.5

PHP PHP=7.0.6

PHP PHP=7.0.7

PHP PHP=7.0.8

PHP PHP=7.0.9

PHP PHP=7.0.10

PHP PHP=7.0.11

PHP PHP=7.0.12

Event History

Jan 4, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-9138?

CVE-2016-9138 has a moderate severity level due to its potential for causing denial of service.

How do I fix CVE-2016-9138?

To fix CVE-2016-9138, upgrade PHP to version 5.6.28 or newer, or to any version in the 7.1 series or later.

What versions of PHP are affected by CVE-2016-9138?