{"id":"CVE-2016-7480","aliases":["EUVD-2016-8333","GHSA-35p7-xqgq-2gx7","SUSE-SU-2017:0534-1","UBUNTU-CVE-2016-7480"],"status":"published","title":"The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12...","description":"The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.41558,"percentile":0.98689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119"],"published":"2017-01-11T06:45:00Z","modified":"2026-10-20T13:14:41Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}]}],"bundled":13}],"products":[{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"php","product":"php"}],"references":[{"url":"http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","report"]},{"url":"https://www.youtube.com/watch?v=LDcaPstAuPk","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","advisory","report"]},{"url":"https://bugs.php.net/bug.php?id=73257","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"http://php.net/ChangeLog-7.php","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/95152","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/php/php-src/commit/61cdd1255d5b9c8453be71aacbbf682796ac77d4","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20180112-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7480"},{"url":"https://security.netapp.com/advisory/ntap-20180112-0001"},{"url":"https://github.com/advisories/GHSA-35p7-xqgq-2gx7"},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170534-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008026","tags":["report"]},{"url":"https://bugzilla.suse.com/1019547","tags":["report"]},{"url":"https://bugzilla.suse.com/1019550","tags":["report"]},{"url":"https://bugzilla.suse.com/1019568","tags":["report"]},{"url":"https://bugzilla.suse.com/1019570","tags":["report"]},{"url":"https://bugzilla.suse.com/1022219","tags":["report"]},{"url":"https://bugzilla.suse.com/1022255","tags":["report"]},{"url":"https://bugzilla.suse.com/1022257","tags":["report"]},{"url":"https://bugzilla.suse.com/1022260","tags":["report"]},{"url":"https://bugzilla.suse.com/1022262","tags":["report"]},{"url":"https://bugzilla.suse.com/1022263","tags":["report"]},{"url":"https://bugzilla.suse.com/1022264","tags":["report"]},{"url":"https://bugzilla.suse.com/1022265","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5340","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-7480","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7480","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-7480","description":"The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.","status":"published","published":"2017-01-11T06:45:00Z","modified":"2024-08-06T01:57:47.646Z","updated_at":"2026-11-02T14:33:36.483151Z"}],"euvd":[{"id":"EUVD-2016-8333","description":"The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.","status":"published","published":"2017-01-11T06:45:00Z","modified":"2024-08-06T01:57:47Z","updated_at":"2026-11-03T02:22:32.939633Z"}],"ghsa":[{"id":"GHSA-35p7-xqgq-2gx7","title":"The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12...","description":"The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.","status":"published","published":"2022-05-14T03:50:14Z","modified":"2025-04-20T03:30:59Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:38.976438Z"}],"nvd":[{"id":"CVE-2016-7480","description":"The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.","status":"published","published":"2017-01-11T07:59:00.143Z","modified":"2026-06-17T00:53:08.217Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:33.686843Z"}],"osv":[{"id":"CVE-2016-7480","description":"The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.","status":"published","published":"2017-01-11T07:59:00.143Z","modified":"2026-10-20T13:14:41.692543606Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"UBUNTU-CVE-2016-7480","description":"The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.","status":"withdrawn","published":"2017-01-11T07:59:00Z","modified":"2025-07-16T07:35:03.229486Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"SUSE-SU-2017:0534-1","title":"Security update for php7","description":"\nThis update for php7 fixes the following security issues:\n\n- CVE-2016-7480: The SplObjectStorage unserialize implementation in\n  ext/spl/spl_observer.c in PHP did not verify that a key is an object,\n  which allowed remote attackers to execute arbitrary code or cause a denial\n  of service (uninitialized memory access) via crafted serialized data.\n  (bsc#1019568)\n- CVE-2017-5340: Zend/zend_hash.c in PHP mishandled certain cases that\n  require large array allocations, which allowed remote attackers to\n  execute arbitrary code or cause a denial of service (integer overflow,\n  uninitialized memory access, and use of arbitrary destructor function\n  pointers) via crafted serialized data. (bsc#1019570)\n- CVE-2016-7479: In all versions of PHP 7, during the unserialization\n  process, resizing the 'properties' hash table of a serialized object may\n  have lead to use-after-free. A remote attacker may exploit this bug to\n  gain arbitrary code execution. (bsc#1019547)\n- CVE-2016-7478: Zend/zend_exceptions.c in PHP allowed remote attackers to\n  cause a denial of service (infinite loop) via a crafted Exception object\n  in serialized data, a related issue to CVE-2015-8876.  (bsc#1019550)\n- CVE-2016-10159: Integer overflow in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory consumption or application crash) via a truncated\n  manifest entry in a PHAR archive. (bsc#1022255)\n- CVE-2016-10160: Off-by-one error in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory corruption) or possibly execute arbitrary code via\n  a crafted PHAR archive with an alias mismatch. (bsc#1022257)\n- CVE-2016-10161: The object_common1 function in\n  ext/standard/var_unserializer.c in PHP allowed remote attackers to\n  cause a denial of service (buffer over-read and application crash) via\n  crafted serialized data that is mishandled in a finish_nested_data call.\n  (bsc#1022260)\n- CVE-2016-10162: The php_wddx_pop_element function in ext/wddx/wddx.c in\n  PHP 7 allowed remote attackers to cause a denial of service (NULL pointer\n  dereference and application crash) via an inapplicable class name in a\n  wddxPacket XML document, leading to mishandling in a wddx_deserialize\n  call. (bsc#1022262)\n- CVE-2016-10166: A potential unsigned underflow in gd interpolation\n  functions could lead to memory corruption in the PHP gd module\n  (bsc#1022263)\n- CVE-2016-10167: A denial of service problem in gdImageCreateFromGd2Ctx()\n  could lead to php out of memory even on small files. (bsc#1022264)\n- CVE-2016-10168: A signed integer overflow in the gd module could lead\n  to memory corruption (bsc#1022265)\n- CVE-2016-9138: PHP mishandled property modification during __wakeup\n  processing, which allows remote attackers to cause a denial of\n  service or possibly have unspecified other impact via crafted\n  serialized data, as demonstrated by Exception::__toString with\n  DateInterval::__wakeup. (bsc#1008026)\n","status":"published","published":"2017-02-22T09:00:09Z","modified":"2026-02-04T04:33:21.241721Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}