CVE-2018-19396 ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
HighCVSS 7.5
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | >= 5.0.0, <= 7.1.24 | No fix listed |
| alpine/php7(Alpine:v3.7) | < 7.1.29-r0 | 7.1.29-r0 |
References
- 105989 third-party-advisory vdb-entry
- bugs.php.net exploit issue-tracking mailing-list vendor-advisory
- security.netapp.com third-party-advisory
- security.alpinelinux.org vendor-advisory