CVE-2016-9138

Published: Jan 4, 2017Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data, as demonstrated by Exception::__toString with DateInterval::__wakeup.

Affected (14)

Products: Php: Php

Php

1 product

Php

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Php Php	version ≤ 5.6.27
Php Php	Version 7.0.0
Php Php	Version 7.0.10
Php Php	Version 7.0.11
Php Php	Version 7.0.12
Php Php	Version 7.0.1
Php Php	Version 7.0.2
Php Php	Version 7.0.3
Php Php	Version 7.0.4
Php Php	Version 7.0.5
Php Php	Version 7.0.6
Php Php	Version 7.0.7
Php Php	Version 7.0.8
Php Php	Version 7.0.9