Description

ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.

Remediation

References

CVE-2016-7124

Related Vulnerabilities

Jenkins Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2018-1000194)

WordPress Plugin Slimstat Analytics Cross-Site Scripting (5.0.4)

MySQL CVE-2019-2778 Vulnerability (CVE-2019-2778)

WordPress Plugin TableOn-WordPress Posts Table Filterable Cross-Site Scripting (1.0.0)

WordPress 4.0.x Multiple Vulnerabilities (4.0 - 4.0.22)

Severity

Critical

Classification

CVE-2016-7124 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities