ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Nov 20, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-fpmUpgrade php-xmlUpgrade php-xmlrpcUpgrade php-commonUpgrade php-ldapUpgrade php-pdoUpgrade php-cliUpgrade php-recodeUpgrade php-odbcUpgrade php-soapUpgrade php-gdUpgrade php-processUpgrade php | Jul 31, 2020 | Nov 20, 2018 |
| Php | — | Upgrade to PHP version 5.6.37Upgrade to PHP version 7.1.25 | Jan 8, 2019 | Nov 20, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub