{"id":"CVE-2016-9137","aliases":["BELL-CVE-2016-9137","DEBIAN-CVE-2016-9137","DSA-3698-1","EUVD-2016-9954","GHSA-cpf6-fjqm-4hx4","SUSE-SU-2016:2941-1","SUSE-SU-2016:2975-1","UBUNTU-CVE-2016-9137","USN-3196-1","USN-3211-1"],"status":"published","title":"Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before...","description":"Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05319,"percentile":0.92653,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2016-10-24T00:00:00Z","modified":"2026-10-24T10:30:31Z","fixes":[{"ecosystem":"Debian:8","package":"php5","fixed_in":["5.6.27+dfsg-0+deb8u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"php5","fixed_in":["5.5.9+dfsg-1ubuntu4.21"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","fixed_in":["7.0.15-0ubuntu0.16.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:8","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.27+dfsg-0+deb8u1"}]}],"versions":["5.6.11+dfsg-1","5.6.12+dfsg-0+deb8u1","5.6.12+dfsg-1","5.6.13+dfsg-0+deb8u1","5.6.13+dfsg-1","5.6.13+dfsg-2","5.6.14+dfsg-0+deb8u1","5.6.14+dfsg-1","5.6.15+dfsg-1","5.6.16+dfsg-1","5.6.16+dfsg-2","5.6.16+dfsg-3","5.6.16+dfsg-4","5.6.17+dfsg-0+deb8u1","5.6.17+dfsg-1","5.6.17+dfsg-3","5.6.18+dfsg-1","5.6.19+dfsg-0+deb8u1","5.6.19+dfsg-1","5.6.19+dfsg-2","5.6.20+dfsg-0+deb8u1","5.6.20+dfsg-1","5.6.21+dfsg-1","5.6.21+dfsg-2","5.6.22+dfsg-0+deb8u1","5.6.22+dfsg-1","5.6.22+dfsg-2","5.6.23+dfsg-0+deb8u1","5.6.23+dfsg-1","5.6.24+dfsg-0+deb8u1","5.6.24+dfsg-1","5.6.26+dfsg-0+deb8u1","5.6.26+dfsg-1","5.6.7+dfsg-1","5.6.9+dfsg-0+deb8u1","5.6.9+dfsg-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2007e_suse-22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2007e_suse-22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2007e_suse-22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-86.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2007e_suse-22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-86.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2007e_suse-22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-86.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2007e_suse-22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2007e_suse-22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.21"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.15-0ubuntu0.16.04.2"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.21"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12","5.5.9+dfsg-1ubuntu4.13","5.5.9+dfsg-1ubuntu4.14","5.5.9+dfsg-1ubuntu4.16","5.5.9+dfsg-1ubuntu4.17","5.5.9+dfsg-1ubuntu4.19","5.5.9+dfsg-1ubuntu4.20"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.15-0ubuntu0.16.04.2"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1"],"bundled":10}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"https://bugs.php.net/bug.php?id=73147","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","evidence"]},{"url":"http://www.php.net/ChangeLog-7.php","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"http://www.php.net/ChangeLog-5.php","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://www.tenable.com/security/tns-2016-19","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/93577","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/11/01/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0e6fe3a4c96be2d3e88389a5776f878021b4c59f","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3698","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9137"},{"url":"http://git.php.net/?p=php-src.git;a=commit;h=0e6fe3a4c96be2d3e88389a5776f878021b4c59f"},{"url":"https://github.com/advisories/GHSA-cpf6-fjqm-4hx4"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2016-9137","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162941-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008029","tags":["report"]},{"url":"https://bugzilla.suse.com/988486","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9137","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162975-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/986247","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5773","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-9137","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/10/18/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3196-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3211-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9912","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-7479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9934","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5340","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-9137","description":"Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.","status":"published","published":"2017-01-04T20:00:00Z","modified":"2024-08-06T02:42:10.922Z","updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2016-9954","description":"Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.","status":"published","published":"2017-01-04T20:00:00Z","modified":"2024-08-06T02:42:10Z","updated_at":"2026-11-03T02:22:28.196866Z"}],"ghsa":[{"id":"GHSA-cpf6-fjqm-4hx4","title":"Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before...","description":"Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.","status":"published","published":"2022-05-17T00:27:18Z","modified":"2025-04-12T13:07:57Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:01:30.991417Z"}],"nvd":[{"id":"CVE-2016-9137","description":"Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.","status":"published","published":"2017-01-04T20:59:00.387Z","modified":"2026-06-17T00:55:34.837Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:03:33.686843Z"}],"osv":[{"id":"BELL-CVE-2016-9137","title":"CVE-2016-9137 does not affect BellSoft software","status":"withdrawn","published":"2017-01-04T20:59:00Z","modified":"2026-01-26T09:48:00.178376Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2016-9137","description":"Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.","status":"published","published":"2017-01-04T20:59:00.387Z","modified":"2026-10-24T10:30:31.957497262Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"UBUNTU-CVE-2016-9137","description":"Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.","status":"published","published":"2017-01-04T00:00:00Z","modified":"2026-04-22T11:03:08.270679Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"DSA-3698-1","title":"php5 - security update","status":"published","published":"2016-10-24T00:00:00Z","modified":"2026-03-09T01:17:47.432629Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"SUSE-SU-2016:2941-1","title":"Security update for php7","description":"\nThis update for php7 fixes the following security issues:\n\n- CVE-2016-5385: Setting HTTP_PROXY environment variable via Proxy header (httpoxy) (bsc#988486).\n- CVE-2016-9137: Fixing a Use After Free in unserialize() (bsc#1008029).\n","status":"published","published":"2016-11-29T12:42:58Z","modified":"2026-02-04T04:28:05.883329Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2975-1","title":"Security update for php5","description":"\nThis update for php5 fixes the following issues:\n\n- CVE-2016-9137: Use After Free in unserialize() (bsc#1008029)\n- CVE-2016-5773: ZipArchive class Use After Free Vulnerability in PHP's GC (bsc#986247)\n","status":"published","published":"2016-12-02T10:40:24Z","modified":"2026-02-04T03:46:45.784091Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3196-1","title":"php5 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain arguments to the\nlocale_get_display_name function. A remote attacker could use this issue to\ncause PHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2014-9912)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\nhang, resulting in a denial of service. (CVE-2016-7478)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-7479)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only applied to Ubuntu 14.04 LTS. (CVE-2016-9137)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service. (CVE-2016-9934)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-9935)\n\nIt was discovered that PHP incorrectly handled certain EXIF data. A remote\nattacker could use this issue to cause PHP to crash, resulting in a denial\nof service. (CVE-2016-10158)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash or consume\nresources, resulting in a denial of service. (CVE-2016-10159)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2016-10160)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service. (CVE-2016-10161)\n","status":"published","published":"2017-02-14T18:44:56Z","modified":"2026-04-22T09:31:26.707533Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-3211-1","title":"php7.0 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-7479)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-9137)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-9935)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-9936)\n\nIt was discovered that PHP incorrectly handled certain EXIF data. A remote\nattacker could use this issue to cause PHP to crash, resulting in a denial\nof service. (CVE-2016-10158)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash or consume\nresources, resulting in a denial of service. (CVE-2016-10159)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2016-10160)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service. (CVE-2016-10161)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service. (CVE-2016-10162)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2017-5340)\n","status":"published","published":"2017-02-23T16:28:50Z","modified":"2026-04-22T09:31:56.613928Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}