CVE-2016-7124

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2016-7124
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7124.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2016-7124
Downstream
Related
Published
2016-09-12T01:59:02Z
Modified
2025-10-21T03:57:33.235852Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

ext/standard/varunserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) _destruct call or (2) magic method call.

References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
20ce2fe8e3c211a42fee05a461a5881be9a8790e

Affected versions

Other

NEWS
NEWS-cvs2svn
POST_64BIT_BRANCH_MERGE
POST_AST_MERGE
POST_NATIVE_TLS_MERGE
POST_PHP7_EREG_MYSQL_REMOVALS
POST_PHP7_NSAPI_REMOVAL
POST_PHP7_REMOVALS
POST_PHPNG_MERGE
PRE_64BIT_BRANCH_MERGE
PRE_AST_MERGE
PRE_NATIVE_TLS_MERGE
PRE_PHP7_EREG_MYSQL_REMOVALS
PRE_PHP7_NSAPI_REMOVAL
PRE_PHP7_REMOVALS
PRE_PHPNG_MERGE

php-5.*

php-5.3.23RC1
php-5.3.29
php-5.3.29RC1
php-5.4.30RC1
php-5.4.32RC1
php-5.4.4RC2
php-5.5.24RC1
php-5.6.18RC1
php-5.6.19RC1
php-5.6.22RC1
php-5.6.23RC1
php-5.6.24RC1

php-7.*

php-7.0.10RC1
php-7.0.3RC1
php-7.0.4RC1
php-7.0.5RC1
php-7.0.7RC1
php-7.0.8RC1
php-7.0.9RC1

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "169849720921714996838282264204312771661",
                "180463871628457325660869400684958788254",
                "301713948484354595382149779914294234729",
                "155950694156038132290118533730662272199",
                "333923463304415863502901611294588587148",
                "296795836952294933869272584514427590032",
                "204823138445432280428496205289403694673",
                "64707571472168145927339570475975333396",
                "266863753961195188763357913713176954006",
                "158769509675285144916651430253595575655",
                "294273554692102979811096774751784143628",
                "49358624513085274802117443557708297915",
                "13937495902180270613518050066130079438",
                "242621266573895990135367668685545687806",
                "294895318309561499038485170654422467621",
                "55368886392051895250425902248938507421",
                "202738099425109652598607823093343010405",
                "270359945965553451130210788877821793793",
                "178074408190174776173054644083240984052",
                "161004201992794952905922455376028032402",
                "256443442956102980253156176491481909713",
                "245156234079906997965178134905212056543",
                "38357063647905450980830399792084476926",
                "297841208556428107634182733912843380320",
                "105601260468247641837079922593086233311",
                "229214502789678528166892145626691965228",
                "165085412075416482056254437518569326156",
                "15810064649009299559749305424076231835",
                "338571307469031367281234957284209074078",
                "198399784374333060432827075156526932948",
                "117342263726605245591362162018137668876",
                "209014482270567659290677305826989128386",
                "81569701171309797811578687876468003129",
                "77560458730927188653033843356675103247",
                "146209983029143421467665555168806545790",
                "94572186954339866726967878204384221426",
                "48321779110189459160257381918145830744",
                "24754866100800727073637253209802501961",
                "27149534096773654746749185512571174272",
                "3168590509649118442290998957538160696",
                "134950658922458088599097211667340242239",
                "311073493313700680847037036467860277806",
                "334247954186085663886773938172028615327",
                "8124929253644059898413828152640482438",
                "315023259646954472987244596244082972809",
                "227625791871056898776791685398078142953",
                "267213367295735964003018920669378865431",
                "230315145720989861748229744962122530726",
                "298424571832229827021382577509442569886",
                "49754869983761234541136207887283096280",
                "181924548937547694667614051998031366443",
                "323370582964872018925716694505996117272",
                "332552104211924362678298058775402743683"
            ]
        },
        "target": {
            "file": "ext/standard/var_unserializer.c"
        },
        "source": "https://github.com/php/php-src/commit/20ce2fe8e3c211a42fee05a461a5881be9a8790e",
        "id": "CVE-2016-7124-130dd5fc",
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "251453263869907950829270780707514998499",
            "length": 17257.0
        },
        "target": {
            "file": "ext/standard/var_unserializer.c",
            "function": "php_var_unserialize_internal"
        },
        "source": "https://github.com/php/php-src/commit/20ce2fe8e3c211a42fee05a461a5881be9a8790e",
        "id": "CVE-2016-7124-cb740059",
        "deprecated": false,
        "signature_version": "v1"
    }
]