Описание
spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.
Ссылки
- PatchThird Party Advisory
- Broken LinkMailing List
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- PatchRelease NotesVendor Advisory
- Third Party Advisory
- Third Party Advisory
- Mailing ListPatchThird Party Advisory
- Third Party AdvisoryVDB Entry
- ExploitIssue TrackingVendor Advisory
- Third Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Broken LinkMailing List
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- PatchRelease NotesVendor Advisory
- Third Party Advisory
- Third Party Advisory
- Mailing ListPatchThird Party Advisory
Уязвимые конфигурации
Одно из
Одно из
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
Связанные уязвимости
spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.
spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.
spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before ...
spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.
Уязвимость расширения SPL интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный PHP-код
EPSS
9.8 Critical
CVSS3
7.5 High
CVSS2