{"id":"CVE-2017-5340","aliases":["EUVD-2017-14445","GHSA-mcgr-9688-597c","RHSA-2018:1296","SUSE-SU-2017:0534-1","UBUNTU-CVE-2017-5340","USN-3211-1"],"status":"published","title":"Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that...","description":"Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.1669,"percentile":0.97044,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2017-01-11T00:00:00Z","modified":"2026-10-20T13:23:47Z","fixes":[{"ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","fixed_in":["7.0.15-0ubuntu0.16.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-php70-php-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el6"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-php70-php-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.27-1.el7"}]}],"bundled":37},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.15-0ubuntu0.16.04.2"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"php7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.15-0ubuntu0.16.04.2"}]}],"versions":["7.0.1-5","7.0.1-6","7.0.2-1","7.0.2-3","7.0.2-4","7.0.2-5","7.0.3-2","7.0.3-3","7.0.3-9ubuntu1","7.0.4-5ubuntu1","7.0.4-5ubuntu2","7.0.4-7ubuntu1","7.0.4-7ubuntu2","7.0.4-7ubuntu2.1","7.0.8-0ubuntu0.16.04.1","7.0.8-0ubuntu0.16.04.2","7.0.8-0ubuntu0.16.04.3","7.0.13-0ubuntu0.16.04.1","7.0.15-0ubuntu0.16.04.1"],"bundled":10}],"products":[{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"php","product":"php"}],"references":[{"url":"https://github.com/php/php-src/commit/4cc0286f2f3780abc6084bcdae5dce595daa3c12","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1296","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180112-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/95371","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugs.php.net/bug.php?id=73832","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","VDB Entry","Vendor Advisory","report"]},{"url":"http://www.securitytracker.com/id/1037659","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5340","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180112-0001"},{"url":"https://github.com/advisories/GHSA-mcgr-9688-597c"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.1_release_notes/chap-rhscl#sect-RHSCL-Changes-php","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377311","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1377352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1404723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1404726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1404731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1404735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1412631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1412686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1418984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1418986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1419020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466730","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466746","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1512057","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1535246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1535251","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1296.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7412","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7412","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7413","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7413","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7413","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7414","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7414","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7414","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7416","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7416","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7416","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7417","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7417","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7417","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7418","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7418","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7479","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7479","tags":["advisory"]},{"url":"https://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9933","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9934","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9934","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9935","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9935","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-9936","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9936","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10158","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10159","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10159","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10160","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10160","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10161","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10161","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10162","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10162","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10162","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10167","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10168","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10168","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10168","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-5340","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5340","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7890","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7890","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7890","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9224","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9226","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9226","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9227","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9227","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9228","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9228","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9228","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-9229","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9229","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11143","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11144","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11144","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11144","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11145","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11147","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11147","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11362","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11362","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11628","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11628","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11628","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12932","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12932","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12933","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-12934","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12934","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-16642","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16642","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-5711","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5711","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-5712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5712","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170534-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008026","tags":["report"]},{"url":"https://bugzilla.suse.com/1019547","tags":["report"]},{"url":"https://bugzilla.suse.com/1019550","tags":["report"]},{"url":"https://bugzilla.suse.com/1019568","tags":["report"]},{"url":"https://bugzilla.suse.com/1019570","tags":["report"]},{"url":"https://bugzilla.suse.com/1022219","tags":["report"]},{"url":"https://bugzilla.suse.com/1022255","tags":["report"]},{"url":"https://bugzilla.suse.com/1022257","tags":["report"]},{"url":"https://bugzilla.suse.com/1022260","tags":["report"]},{"url":"https://bugzilla.suse.com/1022262","tags":["report"]},{"url":"https://bugzilla.suse.com/1022263","tags":["report"]},{"url":"https://bugzilla.suse.com/1022264","tags":["report"]},{"url":"https://bugzilla.suse.com/1022265","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5340","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-5340","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3211-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-7479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9137","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9935","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9936","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10158","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10159","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10161","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10162","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-5340","description":"Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.","status":"published","published":"2017-01-11T06:02:00Z","modified":"2024-08-05T14:55:35.744Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-14445","description":"Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.","status":"published","published":"2017-01-11T06:02:00Z","modified":"2024-08-05T14:55:35Z","updated_at":"2026-11-03T02:39:16.415448Z"}],"ghsa":[{"id":"GHSA-mcgr-9688-597c","title":"Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that...","description":"Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.","status":"published","published":"2022-05-14T03:27:13Z","modified":"2025-04-20T03:30:59Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:01:38.976438Z"}],"nvd":[{"id":"CVE-2017-5340","description":"Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.","status":"published","published":"2017-01-11T06:59:00.16Z","modified":"2026-06-17T01:20:17.873Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:03:42.372487Z"}],"osv":[{"id":"CVE-2017-5340","description":"Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.","status":"published","published":"2017-01-11T06:59:00.16Z","modified":"2026-10-20T13:23:47.596571058Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.029968Z"},{"id":"RHSA-2018:1296","title":"Red Hat Security Advisory: rh-php70-php security, bug fix, and enhancement update","status":"published","published":"2024-09-13T16:50:16Z","modified":"2026-06-29T10:20:06Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2017-5340","description":"Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.","status":"published","published":"2017-01-11T00:00:00Z","modified":"2026-04-22T11:26:43.198743Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"SUSE-SU-2017:0534-1","title":"Security update for php7","description":"\nThis update for php7 fixes the following security issues:\n\n- CVE-2016-7480: The SplObjectStorage unserialize implementation in\n  ext/spl/spl_observer.c in PHP did not verify that a key is an object,\n  which allowed remote attackers to execute arbitrary code or cause a denial\n  of service (uninitialized memory access) via crafted serialized data.\n  (bsc#1019568)\n- CVE-2017-5340: Zend/zend_hash.c in PHP mishandled certain cases that\n  require large array allocations, which allowed remote attackers to\n  execute arbitrary code or cause a denial of service (integer overflow,\n  uninitialized memory access, and use of arbitrary destructor function\n  pointers) via crafted serialized data. (bsc#1019570)\n- CVE-2016-7479: In all versions of PHP 7, during the unserialization\n  process, resizing the 'properties' hash table of a serialized object may\n  have lead to use-after-free. A remote attacker may exploit this bug to\n  gain arbitrary code execution. (bsc#1019547)\n- CVE-2016-7478: Zend/zend_exceptions.c in PHP allowed remote attackers to\n  cause a denial of service (infinite loop) via a crafted Exception object\n  in serialized data, a related issue to CVE-2015-8876.  (bsc#1019550)\n- CVE-2016-10159: Integer overflow in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory consumption or application crash) via a truncated\n  manifest entry in a PHAR archive. (bsc#1022255)\n- CVE-2016-10160: Off-by-one error in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory corruption) or possibly execute arbitrary code via\n  a crafted PHAR archive with an alias mismatch. (bsc#1022257)\n- CVE-2016-10161: The object_common1 function in\n  ext/standard/var_unserializer.c in PHP allowed remote attackers to\n  cause a denial of service (buffer over-read and application crash) via\n  crafted serialized data that is mishandled in a finish_nested_data call.\n  (bsc#1022260)\n- CVE-2016-10162: The php_wddx_pop_element function in ext/wddx/wddx.c in\n  PHP 7 allowed remote attackers to cause a denial of service (NULL pointer\n  dereference and application crash) via an inapplicable class name in a\n  wddxPacket XML document, leading to mishandling in a wddx_deserialize\n  call. (bsc#1022262)\n- CVE-2016-10166: A potential unsigned underflow in gd interpolation\n  functions could lead to memory corruption in the PHP gd module\n  (bsc#1022263)\n- CVE-2016-10167: A denial of service problem in gdImageCreateFromGd2Ctx()\n  could lead to php out of memory even on small files. (bsc#1022264)\n- CVE-2016-10168: A signed integer overflow in the gd module could lead\n  to memory corruption (bsc#1022265)\n- CVE-2016-9138: PHP mishandled property modification during __wakeup\n  processing, which allows remote attackers to cause a denial of\n  service or possibly have unspecified other impact via crafted\n  serialized data, as demonstrated by Exception::__toString with\n  DateInterval::__wakeup. (bsc#1008026)\n","status":"published","published":"2017-02-22T09:00:09Z","modified":"2026-02-04T04:33:21.241721Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3211-1","title":"php7.0 vulnerabilities","description":"It was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-7479)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-9137)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-9935)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-9936)\n\nIt was discovered that PHP incorrectly handled certain EXIF data. A remote\nattacker could use this issue to cause PHP to crash, resulting in a denial\nof service. (CVE-2016-10158)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash or consume\nresources, resulting in a denial of service. (CVE-2016-10159)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2016-10160)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service. (CVE-2016-10161)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service. (CVE-2016-10162)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2017-5340)\n","status":"published","published":"2017-02-23T16:28:50Z","modified":"2026-04-22T09:31:56.613928Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}