CVE-2016-7478

HIGH

PHP - Denial of Service via Crafted Exception Object in Serialized Data

Title source: llm

Description

Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.

References (6)

Core 6

Core References

Third Party Advisory x_refsource_misc

http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/95150

Press/Media Coverage x_refsource_misc

https://www.youtube.com/watch?v=LDcaPstAuPk

Vendor Advisory x_refsource_confirm

https://security.netapp.com/advisory/ntap-20180112-0001/

Third Party Advisory, VDB Entry x_refsource_misc

http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7

Exploit, Vendor Advisory x_refsource_misc

https://bugs.php.net/bug.php?id=73093

Scores

CVSS v3 7.5

EPSS 0.1886

EPSS Percentile 95.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

Status published

Products (43)

n/a/PHP before 5.6.28 PHP before 5.6.28

php/php 5.0.0 (8 CPE variants)

php/php 5.0.1

php/php 5.0.2

php/php 5.0.3

php/php 5.0.4

php/php 5.0.5

php/php 5.1.0

php/php 5.1.1

php/php 5.1.2

... and 33 more

Published Jan 11, 2017

Tracked Since Feb 18, 2026