CVE-2016-7480
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2016-7480
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7480.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2016-7480
- Downstream
- Related
- Published
- 2017-01-11T07:59:00Z
- Modified
- 2025-10-10T00:49:17.653881Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.
- References
-
- http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7
- http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf
- http://php.net/ChangeLog-7.php
- http://www.securityfocus.com/bid/95152
- https://bugs.php.net/bug.php?id=73257
- https://github.com/php/php-src/commit/61cdd1255d5b9c8453be71aacbbf682796ac77d4
- https://security.netapp.com/advisory/ntap-20180112-0001/
- https://www.youtube.com/watch?v=LDcaPstAuPk
Affected packages
Git / github.com/php/php-src
Affected ranges
- Type
- GIT
- Repo
- https://github.com/php/php-src
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
Other
NEWS
NEWS-cvs2svn
POST_64BIT_BRANCH_MERGE
POST_AST_MERGE
POST_NATIVE_TLS_MERGE
POST_PHP7_EREG_MYSQL_REMOVALS
POST_PHP7_NSAPI_REMOVAL
POST_PHP7_REMOVALS
POST_PHPNG_MERGE
PRE_64BIT_BRANCH_MERGE
PRE_AST_MERGE
PRE_NATIVE_TLS_MERGE
PRE_PHP7_EREG_MYSQL_REMOVALS
PRE_PHP7_NSAPI_REMOVAL
PRE_PHP7_REMOVALS
PRE_PHPNG_MERGE
php-5.*
php-5.3.23RC1
php-5.3.29
php-5.3.29RC1
php-5.4.30RC1
php-5.4.32RC1
php-5.4.4RC2
php-5.5.24RC1
php-5.6.18RC1
php-5.6.19RC1
php-5.6.22RC1
php-5.6.23RC1
php-5.6.24RC1
php-7.*
php-7.0.11RC1
php-7.0.3RC1
php-7.0.4RC1
php-7.0.5RC1
php-7.0.7RC1
php-7.0.8RC1
php-7.0.9RC1
Database specific
{
"vanir_signatures": [
{
"id": "CVE-2016-7480-40b4ffdc",
"digest": {
"length": 2208.0,
"function_hash": "120263227596398378617375601141451063602"
},
"target": {
"function": "SPL_METHOD",
"file": "ext/spl/spl_observer.c"
},
"source": "https://github.com/php/php-src/commit/61cdd1255d5b9c8453be71aacbbf682796ac77d4",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2016-7480-8f33d31a",
"digest": {
"line_hashes": [
"311234878759843067834920731248114505772",
"50912414707171288631538515995604057141",
"162017028089509586153324425077756765976",
"242884483502019213952707469980360057644",
"336387103315920007587990593317693867963",
"21580564470928238072623097181749639560",
"283797390797428005224407026009247451270",
"219637822043791896869783149654081588089",
"178852092846835038102390099040886447181",
"136146387223299992562308475632779719063",
"288364703481122890929991226047229929241",
"126765909629768321856645271021163435983",
"105038064802166019778237222904298848318",
"257724883922067736173061222643725001998",
"38772639687927117305721988887639643782",
"167676080273695483373820046130328174003",
"21336750416930265615946273101896440205",
"242713924649718161698991874615444863252"
],
"threshold": 0.9
},
"target": {
"file": "ext/spl/spl_observer.c"
},
"source": "https://github.com/php/php-src/commit/61cdd1255d5b9c8453be71aacbbf682796ac77d4",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
}
]
}