CVE-2017-12932: Use After Free
ext/standard/varunserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
Upstream patch:
https://github.com/php/php-src/commit/1a23ebc1fff59bf480ca92963b36eba5c1b904c4
Upstream bug:
https://bugs.php.net/bug.php?id=74103
Other sources
Fixed bug (heap-use-after-free when unserializing invalid array size). (CVE-2017-12932)
— PHP
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12932?
CVE-2017-12932 is classified as a high severity vulnerability due to its potential for exploitation in PHP versions 7.0.x up to 7.0.22 and 7.1.x up to 7.1.8.
How do I fix CVE-2017-12932?
To remediate CVE-2017-12932, upgrade PHP to version 7.0.23 or later for 7.0.x and to version 7.1.9 or later for 7.1.x.
What vulnerabilities are linked to CVE-2017-12932?
CVE-2017-12932 is specifically related to a heap use after free vulnerability during the unserialization of untrusted data in specific PHP versions.
Which PHP versions are affected by CVE-2017-12932?
CVE-2017-12932 affects PHP versions 7.0.0 to 7.0.22 and 7.1.0 to 7.1.8.
Is CVE-2017-12932 a remote code execution vulnerability?
CVE-2017-12932 can lead to various exploitations including potential remote code execution if successful.