CVE-2016-9936: Use After Free
A use-after-free vulnerability was found in unserialize().
Upstream bug:
https://bugs.php.net/bug.php?id=72978
Upstream patch:
https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17
CVE assignment:
http://seclists.org/oss-sec/2016/q4/658
Other sources
Fixed bug (Use After Free Vulnerability in unserialize()). (CVE-2016-9936)
— PHP
The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9936?
CVE-2016-9936 is a high severity vulnerability that allows remote attackers to cause denial of service.
How do I fix CVE-2016-9936?
To fix CVE-2016-9936, upgrade PHP to version 7.0.14 or 7.1.0 or later.
Which versions of PHP are affected by CVE-2016-9936?
PHP versions 7.0.0 through 7.0.13 and PHP 7.1.0 are affected by CVE-2016-9936.
What type of vulnerability is CVE-2016-9936?
CVE-2016-9936 is a use-after-free vulnerability that can be exploited via crafted serialized data.
Is there any known exploit for CVE-2016-9936?
While specific exploits for CVE-2016-9936 are not publicized, it is considered a serious risk due to its potential for denial of service.