Description
ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.
Remediation
References
Related Vulnerabilities
Joomla Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-9837)
MyBB Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-9418)
Drupal Core 6.x Multiple Cross-Site Scripting Vulnerabilities (6.0 - 6.20)
PostgreSQL Improper Access Control Vulnerability (CVE-2016-7048)