Red Hat Bugzilla – Bug 1351173
CVE-2016-5771 php: Use After Free Vulnerability in PHP's GC algorithm and unserialize
Last modified: 2016-11-15 09:45:39 EST
A use after free vulnerability was discovered when PHP's garbage collection algorithm interacts with other specific PHP objects. This vulnerability has wide reaching effects like allowing the exploitation of unserialize to gain remote code execution on a target system. Upstream bug: https://bugs.php.net/bug.php?id=72433 Upstream patch: http://git.php.net/?p=php-src.git;a=commitdiff;h=3f627e580acfdaf0595ae3b115b8bec677f203ee CVE assignment: http://seclists.org/oss-sec/2016/q2/589
Created php tracking bugs for this issue: Affects: fedora-all [bug 1351180]
php-5.6.23-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
php-5.6.23-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
php-5.6.23-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
This issue happens when untrusted input is unserialized. Doing so it documented as being unsafe: http://php.net/manual/en/function.unserialize.php Do not pass untrusted user input to unserialize(). Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via json_decode() and json_encode()) if you need to pass serialized data to the user.
More details about this issue can be found in: https://www.evonide.com/breaking-phps-garbage-collection-and-unserialize/
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html