#VU205 Use-after-free error in unserialize() in PHP and macOS - CVE-2016-6290

Vulnerability identifier: #VU205

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2016-6290

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
PHP
macOS

Software vendor:
PHP Group
Apple Inc.

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an use-after-free erorr in unserialize() function. A remote unauthenticated attacker can cause memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install the latest versions: (5.5.38, 5.6.24, 7.0.9).

• https://bugs.php.net/bug.php?id=72562
• http://php.net/ChangeLog-5.php#5.5.38
• http://php.net/ChangeLog-5.php#5.6.24
• http://php.net/ChangeLog-7.php#7.0.9
• https://support.apple.com/en-us/HT207170