Use-after-free error in unserialize() in PHP and macOS - CVE-2016-6290

Vulnerability identifier: #VU205

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6290

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an use-after-free erorr in unserialize() function. A remote unauthenticated attacker can cause memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

PHP
macOS

Install the latest versions: (5.5.38, 5.6.24, 7.0.9).

• https://bugs.php.net/bug.php?id=72562
• http://php.net/ChangeLog-5.php#5.5.38
• http://php.net/ChangeLog-5.php#5.6.24
• http://php.net/ChangeLog-7.php#7.0.9
• https://support.apple.com/en-us/HT207170

• Multiple vulnerabilities in PHP