Use-after-free error in unserialize() in PHP and macOS - CVE-2016-6290

Vulnerability identifier: #VU205

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2016-6290

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: PHP Group
Apple Inc.

Affected software:
PHP
macOS

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an use-after-free erorr in unserialize() function. A remote unauthenticated attacker can cause memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install the latest versions: (5.5.38, 5.6.24, 7.0.9).

• https://bugs.php.net/bug.php?id=72562
• http://php.net/ChangeLog-5.php#5.5.38
• http://php.net/ChangeLog-5.php#5.6.24
• http://php.net/ChangeLog-7.php#7.0.9
• https://support.apple.com/en-us/HT207170