critical
CVE-2016-7479
php: Use-after-free vulnerability when resizing the 'properties' hash table of a serialized object
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Amazon (medium), Ubuntu (medium).
Description
In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | php70, php70-bcmath, php70-cli and 31 more | 7.0.16-1.21.amzn1 |
| debian 7 | php5 | 5.4.45-0+deb7u8 |
| debian 8 | php5 | 5.6.30+dfsg-0+deb8u1 |
| Red Hat | php, php-bcmath, php-cli and 25 more | no fix listed |
| ubuntu 12.04 | php5 | 5.3.10-1ubuntu3.26 |
| ubuntu 14.04 | php5 | 5.5.9+dfsg-1ubuntu4.21 |
| ubuntu 14.04-ESM | php5 | 5.5.9+dfsg-1ubuntu4.21 |
| ubuntu 16.04 | php7.0 | 7.0.15-0ubuntu0.16.04.2 |
| ubuntu 16.04-ESM | php7.0 | 7.0.15-0ubuntu0.16.04.2 |
| ubuntu 16.10 | php7.0 | 7.0.15-0ubuntu0.16.10.2 |
Show all 70 entries from 10 sources
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | php70 | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-bcmath | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-cli | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-common | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-dba | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-dbg | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-debuginfo | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-devel | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-embedded | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-enchant | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-fpm | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-gd | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-gmp | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-imap | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-intl | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-json | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-ldap | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-mbstring | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-mcrypt | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-mysqlnd | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-odbc | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-opcache | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-pdo | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-pdo-dblib | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-pgsql | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-process | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-pspell | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-recode | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-snmp | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-soap | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-tidy | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-xml | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-xmlrpc | 7.0.16-1.21.amzn1 |
| amazon linux 1 | php70-zip | 7.0.16-1.21.amzn1 |
| debian 7 | php5 | 5.4.45-0+deb7u8 |
| debian 8 | php5 | 5.6.30+dfsg-0+deb8u1 |
| Red Hat | php | no fix listed |
| Red Hat | php-bcmath | no fix listed |
| Red Hat | php-cli | no fix listed |
| Red Hat | php-common | no fix listed |
| Red Hat | php-dba | no fix listed |
| Red Hat | php-devel | no fix listed |
| Red Hat | php-embedded | no fix listed |
| Red Hat | php-enchant | no fix listed |
| Red Hat | php-fpm | no fix listed |
| Red Hat | php-gd | no fix listed |
| Red Hat | php-imap | no fix listed |
| Red Hat | php-intl | no fix listed |
| Red Hat | php-ldap | no fix listed |
| Red Hat | php-mbstring | no fix listed |
| Red Hat | php-mysql | no fix listed |
| Red Hat | php-mysqlnd | no fix listed |
| Red Hat | php-odbc | no fix listed |
| Red Hat | php-pdo | no fix listed |
| Red Hat | php-pgsql | no fix listed |
| Red Hat | php-process | no fix listed |
| Red Hat | php-pspell | no fix listed |
| Red Hat | php-recode | no fix listed |
| Red Hat | php-snmp | no fix listed |
| Red Hat | php-soap | no fix listed |
| Red Hat | php-tidy | no fix listed |
| Red Hat | php-xml | no fix listed |
| Red Hat | php-xmlrpc | no fix listed |
| Red Hat | php-zts | no fix listed |
| ubuntu 12.04 | php5 | 5.3.10-1ubuntu3.26 |
| ubuntu 14.04 | php5 | 5.5.9+dfsg-1ubuntu4.21 |
| ubuntu 14.04-ESM | php5 | 5.5.9+dfsg-1ubuntu4.21 |
| ubuntu 16.04 | php7.0 | 7.0.15-0ubuntu0.16.04.2 |
| ubuntu 16.04-ESM | php7.0 | 7.0.15-0ubuntu0.16.04.2 |
| ubuntu 16.10 | php7.0 | 7.0.15-0ubuntu0.16.10.2 |
References
- http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7
- http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf
- http://www.securityfocus.com/bid/95151
- http://www.securitytracker.com/id/1037659
- https://access.redhat.com/errata/RHSA-2018:1296
- https://access.redhat.com/security/cve/CVE-2016-7479
- https://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf
- https://bugs.php.net/bug.php?id=73092