Use-after-free error in PHP - CVE-2016-7479

Vulnerability identifier: #VU12900

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-7479

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to resizing the 'properties' hash table of a serialized object during the unserialization process. A remote attacker can trigger use-after-free error and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

PHP
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Ubuntu
php5 (Ubuntu package)
php7.0-fpm (Ubuntu package)
libapache2-mod-php7.0 (Ubuntu package)
php7.0-cli (Ubuntu package)
php7.0-cgi (Ubuntu package)

Install update from vendor's website.

php5 (Ubuntu package) - addressed in versions 5.3.10-1ubuntu3.26, 5.5.9+dfsg-1ubuntu4.21
php7.0-fpm (Ubuntu package) - addressed in versions 7.0.15-0ubuntu0.16.04.2, 7.0.15-0ubuntu0.16.10.2
libapache2-mod-php7.0 (Ubuntu package) - addressed in versions 7.0.15-0ubuntu0.16.04.2, 7.0.15-0ubuntu0.16.10.2
php7.0-cli (Ubuntu package) - addressed in versions 7.0.15-0ubuntu0.16.04.2, 7.0.15-0ubuntu0.16.10.2
php7.0-cgi (Ubuntu package) - addressed in versions 7.0.15-0ubuntu0.16.04.2, 7.0.15-0ubuntu0.16.10.2

• Exploit #2685 - CPR-Zero: CVE-2016-7479 (May 18, 2020)

• https://bugs.php.net/bug.php?id=73092

• Red Hat update for php
• Amazon Linux AMI update for php70
• Ubuntu update for PHP
• Ubuntu update for php7.0