CVE-2016-6290
php: Use after free in unserialize() with Unexpected Session Deserialization
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Ubuntu (medium).
Description
ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 7 | php5 | 5.4.45-0+deb7u5 |
| debian 8 | php5 | 5.6.24+dfsg-0+deb8u1 |
| Red Hat | php, php-bcmath, php-cli and 25 more | no fix listed |
| ubuntu 12.04 | php5 | 5.3.10-1ubuntu3.24 |
| ubuntu 14.04 | php5 | 5.5.9+dfsg-1ubuntu4.19 |
| ubuntu 14.04-ESM | php5 | 5.5.9+dfsg-1ubuntu4.19 |
| ubuntu 16.04 | php7.0 | 7.0.8-0ubuntu0.16.04.2 |
| ubuntu 16.04-ESM | php7.0 | 7.0.8-0ubuntu0.16.04.2 |
Show all 35 entries from 8 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 7 | php5 | 5.4.45-0+deb7u5 |
| debian 8 | php5 | 5.6.24+dfsg-0+deb8u1 |
| Red Hat | php | no fix listed |
| Red Hat | php-bcmath | no fix listed |
| Red Hat | php-cli | no fix listed |
| Red Hat | php-common | no fix listed |
| Red Hat | php-dba | no fix listed |
| Red Hat | php-devel | no fix listed |
| Red Hat | php-embedded | no fix listed |
| Red Hat | php-enchant | no fix listed |
| Red Hat | php-fpm | no fix listed |
| Red Hat | php-gd | no fix listed |
| Red Hat | php-imap | no fix listed |
| Red Hat | php-intl | no fix listed |
| Red Hat | php-ldap | no fix listed |
| Red Hat | php-mbstring | no fix listed |
| Red Hat | php-mysql | no fix listed |
| Red Hat | php-mysqlnd | no fix listed |
| Red Hat | php-odbc | no fix listed |
| Red Hat | php-pdo | no fix listed |
| Red Hat | php-pgsql | no fix listed |
| Red Hat | php-process | no fix listed |
| Red Hat | php-pspell | no fix listed |
| Red Hat | php-recode | no fix listed |
| Red Hat | php-snmp | no fix listed |
| Red Hat | php-soap | no fix listed |
| Red Hat | php-tidy | no fix listed |
| Red Hat | php-xml | no fix listed |
| Red Hat | php-xmlrpc | no fix listed |
| Red Hat | php-zts | no fix listed |
| ubuntu 12.04 | php5 | 5.3.10-1ubuntu3.24 |
| ubuntu 14.04 | php5 | 5.5.9+dfsg-1ubuntu4.19 |
| ubuntu 14.04-ESM | php5 | 5.5.9+dfsg-1ubuntu4.19 |
| ubuntu 16.04 | php7.0 | 7.0.8-0ubuntu0.16.04.2 |
| ubuntu 16.04-ESM | php7.0 | 7.0.8-0ubuntu0.16.04.2 |
References
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=3798eb6fd5dddb211b01d41495072fd9858d4e32
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
- http://openwall.com/lists/oss-security/2016/07/24/2
- http://php.net/ChangeLog-5.php
- http://php.net/ChangeLog-7.php
- http://rhn.redhat.com/errata/RHSA-2016-2750.html
- http://www.debian.org/security/2016/dsa-3631
- http://www.securityfocus.com/bid/92097
All 16 references
- http://www.securitytracker.com/id/1036430
- https://access.redhat.com/security/cve/CVE-2016-6290
- https://bugs.php.net/72562
- https://nvd.nist.gov/vuln/detail/CVE-2016-6290
- https://security.gentoo.org/glsa/201611-22
- https://support.apple.com/HT207170
- https://ubuntu.com/security/notices/USN-3045-1
- https://www.cve.org/CVERecord?id=CVE-2016-6290