ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Nov 20, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-soapUpgrade php-odbcUpgrade phpUpgrade php-processUpgrade php-gdUpgrade php-pdoUpgrade php-ldapUpgrade php-fpmUpgrade php-xmlUpgrade php-xmlrpcUpgrade php-recodeUpgrade php-commonUpgrade php-cli | Jul 31, 2020 | Nov 20, 2018 |
| Php | — | Upgrade to PHP version 5.6.37Upgrade to PHP version 7.1.25 | Jan 8, 2019 | Nov 20, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub