ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Nov 20, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-cliUpgrade php-pdoUpgrade php-xmlUpgrade php-commonUpgrade php-recodeUpgrade php-ldapUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-soapUpgrade phpUpgrade php-gdUpgrade php-processUpgrade php-odbc | Jul 31, 2020 | Nov 20, 2018 |
| Php | — | Upgrade to PHP version 7.1.25Upgrade to PHP version 5.6.37 | Jan 8, 2019 | Nov 20, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub