A use-after-free vulnerability in with GC and unserialize() was found. Upstream bug: https://bugs.php.net/bug.php?id=72479 Upstream patch: http://git.php.net/?p=php-src.git;a=commit;h=cab1c3b3708eead315e033359d07049b23b147a3 CVE assignment: http://seclists.org/oss-sec/2016/q3/137
Created php tracking bugs for this issue: Affects: fedora-all [bug 1359837]
PHP prior to 5.4.0 does not have this class and is not affected. Reliable remote exploitation most likely requires the use of input unserialization. Doing so it documented as being unsafe: http://php.net/manual/en/function.unserialize.php Do not pass untrusted user input to unserialize(). Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via json_decode() and json_encode()) if you need to pass serialized data to the user. There may be other methods, but those are probably not very suitable to exploit this remotely in a realistic scenario.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html