A use after free vulnerability was discovered when PHP's garbage collection algorithm interacts with other specific PHP objects. This vulnerability has wide reaching effects like allowing the exploitation of unserialize to gain remote code execution on a target system. Upstream bug: https://bugs.php.net/bug.php?id=72434 Upstream patch: http://git.php.net/?p=php-src.git;a=commitdiff;h=f6aef68089221c5ea047d4a74224ee3deead99a6 CVE assignment: http://seclists.org/oss-sec/2016/q2/589
Created php tracking bugs for this issue: Affects: fedora-all [bug 1351180]
php-pecl-zip-1.13.3-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
php-pecl-zip-1.12.5-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
php-pecl-zip-1.13.3-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Analysis: This seems to be very similar to CVE-2016-5771 security flaw. There is a use-after-free flaw in the garbage collector for the zip class. When a specially crafted zip file is processed via php-zip class, it may result in crash or arbitrary code execution.
This issue happens when untrusted input is unserialized. Doing so it documented as being unsafe: http://php.net/manual/en/function.unserialize.php Do not pass untrusted user input to unserialize(). Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via json_decode() and json_encode()) if you need to pass serialized data to the user.
More details about this issue can be found in: https://www.evonide.com/breaking-phps-garbage-collection-and-unserialize/
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html