CVE-2017-12934

Published: Aug 18, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

ext/standard/var_unserializer.re in PHP 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a heap use after free while unserializing untrusted data, related to the zval_get_type function in Zend/zend_types.h. Exploitation of this issue can have an unspecified impact on the integrity of PHP.

Affected (28)

Products: Php: Php

Php

1 product

Php

Configuration A

28 vulnerable

Vulnerable Software	Affected Versions
Php Php	Version 7.0.0
Php Php	Version 7.0.10
Php Php	Version 7.0.11
Php Php	Version 7.0.12
Php Php	Version 7.0.13
Php Php	Version 7.0.14
Php Php	Version 7.0.15
Php Php	Version 7.0.16
Php Php	Version 7.0.17
Php Php	Version 7.0.18
Php Php	Version 7.0.19
Php Php	Version 7.0.1
Php Php	Version 7.0.20
Php Php	Version 7.0.2
Php Php	Version 7.0.3
Php Php	Version 7.0.4
Php Php	Version 7.0.5
Php Php	Version 7.0.6
Php Php	Version 7.0.7
Php Php	Version 7.0.8
Php Php	Version 7.0.9
Php Php	Version 7.1.0
Php Php	Version 7.1.1
Php Php	Version 7.1.2
Php Php	Version 7.1.3
Php Php	Version 7.1.4
Php Php	Version 7.1.5
Php Php	Version 7.1.6