Changes between Initial Version and Version 3 of Ticket #8779


Ignore:
Timestamp:
01/23/2017 03:08:10 PM (8 years ago)
Author:
Douglas R. Reno
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #8779

    • Property Owner changed from blfs-book@… to Douglas R. Reno
    • Property Status new → assigned
    • Property Priority normal → high
    • Property Summary PHP-7.1.1 → PHP-7.1.1 (CVE-2016-9935 CVE-2016-9936 CVE-2017-5430)

  • TabularUnified Ticket #8779 – Description

    initial v3  
    5959
    6060}}}
     61
     62{{{
     63- CVE-2016-9935 (denial of service)
     64
     65The php_wddx_push_element function in ext/wddx/wddx.c in PHP before
     665.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial
     67of service (out-of-bounds read and memory corruption) or possibly have
     68unspecified other impact via an empty boolean element in a wddxPacket
     69XML document.
     70
     71- CVE-2016-9936 (arbitrary code execution)
     72
     73The unserialize implementation in ext/standard/var.c in PHP 7.x before
     747.0.14 allows remote attackers to cause a denial of service (use-after-
     75free) or possibly execute arbitrary code via crafted serialized data.
     76
     77- CVE-2017-5340 (arbitrary code execution)
     78
     79It was found that PHP uses uninitialized memory during calls to
     80`unserialize()`. The payload supplied to `unserialize()` may control
     81this uninitialized memory region and thus may be used to trick PHP into
     82operating on faked objects and calling attacker controlled destructor
     83function pointers, effectively allowing arbitrary code execution via
     84specially crafted serialized data.
     85
     86Impact
     87======
     88
     89A remote attacker is able to use specially crafted input to perform a
     90denial of service attack or execute arbitrary code on the affected
     91host.
     92}}}