Vulnerability-Lookup

ubuntu-cve-2016-9936

Vulnerability from osv_ubuntu

Published

2017-01-04 00:00

Modified

2026-04-22 07:38

Summary

Details

The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834.

Severity

9.8 (Critical)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-9936	REPORT
	http://www.openwall.com/lists/oss-security/2016/12/12/2	REPORT
	https://ubuntu.com/security/notices/USN-3211-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-9936	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libapache2-mod-php7.0",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "libphp7.0-embed",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-bcmath",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-bz2",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-cgi",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-cli",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-common",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-curl",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-dba",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-enchant",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-fpm",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-gd",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-gmp",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-imap",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-interbase",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-intl",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-json",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-ldap",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-mbstring",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-mcrypt",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-mysql",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-odbc",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-opcache",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-pgsql",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-phpdbg",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-pspell",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-readline",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-recode",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-snmp",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-soap",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-sqlite3",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-sybase",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-tidy",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-xml",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-xmlrpc",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-xsl",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-zip",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "php7.0",
        "purl": "pkg:deb/ubuntu/php7.0@7.0.15-0ubuntu0.16.04.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.15-0ubuntu0.16.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.1-5",
        "7.0.1-6",
        "7.0.2-1",
        "7.0.2-3",
        "7.0.2-4",
        "7.0.2-5",
        "7.0.3-2",
        "7.0.3-3",
        "7.0.3-9ubuntu1",
        "7.0.4-5ubuntu1",
        "7.0.4-5ubuntu2",
        "7.0.4-7ubuntu1",
        "7.0.4-7ubuntu2",
        "7.0.4-7ubuntu2.1",
        "7.0.8-0ubuntu0.16.04.1",
        "7.0.8-0ubuntu0.16.04.2",
        "7.0.8-0ubuntu0.16.04.3",
        "7.0.13-0ubuntu0.16.04.1",
        "7.0.15-0ubuntu0.16.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834.",
  "id": "UBUNTU-CVE-2016-9936",
  "modified": "2026-04-22T07:38:05Z",
  "published": "2017-01-04T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9936"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2016/12/12/2"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3211-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-9936"
    }
  ],
  "related": [
    "USN-3211-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-9936"
  ]
}

CVE-2016-9936 (GCVE-0-2016-9936)

Vulnerability from cvelistv5 – Published: 2017-01-04 20:00 – Updated: 2024-08-06 03:07

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre

References

7 references

URL	Tags
http://www.openwall.com/lists/oss-security/2016/12/12/2	mailing-listx_refsource_MLIST
http://www.php.net/ChangeLog-7.php	x_refsource_CONFIRM
https://github.com/php/php-src/commit/b2af4e88687…	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:1296	vendor-advisoryx_refsource_REDHAT
https://bugs.php.net/bug.php?id=72978	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-updates/2017-0…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/94849	vdb-entryx_refsource_BID

Date Public

2016-12-08 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T03:07:31.127Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20161212 CVE assignment for PHP 5.6.28, 5.6.29, 7.0.13, 7.0.14 and 7.1.0",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/12/12/2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.php.net/ChangeLog-7.php"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17"
          },
          {
            "name": "RHSA-2018:1296",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:1296"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.php.net/bug.php?id=72978"
          },
          {
            "name": "openSUSE-SU-2017:0061",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html"
          },
          {
            "name": "94849",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94849"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-12-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-03T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[oss-security] 20161212 CVE assignment for PHP 5.6.28, 5.6.29, 7.0.13, 7.0.14 and 7.1.0",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/12/12/2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.php.net/ChangeLog-7.php"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17"
        },
        {
          "name": "RHSA-2018:1296",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:1296"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.php.net/bug.php?id=72978"
        },
        {
          "name": "openSUSE-SU-2017:0061",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html"
        },
        {
          "name": "94849",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94849"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-9936",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6834."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20161212 CVE assignment for PHP 5.6.28, 5.6.29, 7.0.13, 7.0.14 and 7.1.0",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/12/12/2"
            },
            {
              "name": "http://www.php.net/ChangeLog-7.php",
              "refsource": "CONFIRM",
              "url": "http://www.php.net/ChangeLog-7.php"
            },
            {
              "name": "https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17",
              "refsource": "CONFIRM",
              "url": "https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17"
            },
            {
              "name": "RHSA-2018:1296",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:1296"
            },
            {
              "name": "https://bugs.php.net/bug.php?id=72978",
              "refsource": "CONFIRM",
              "url": "https://bugs.php.net/bug.php?id=72978"
            },
            {
              "name": "openSUSE-SU-2017:0061",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html"
            },
            {
              "name": "94849",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94849"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-9936",
    "datePublished": "2017-01-04T20:00:00.000Z",
    "dateReserved": "2016-12-12T00:00:00.000Z",
    "dateUpdated": "2024-08-06T03:07:31.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-3211-1

Vulnerability from osv_ubuntu

Published

2017-02-23 16:28

Modified

2026-04-22 07:36

Summary

php7.0 vulnerabilities

Details

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7479)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9935)

It was discovered that PHP incorrectly handled certain EXIF data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10158)

It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this issue to cause PHP to crash or consume resources, resulting in a denial of service. (CVE-2016-10159)

It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-10160)

References

URL

Type

	https://ubuntu.com/security/notices/USN-3211-1	ADVISORY
	https://ubuntu.com/security/CVE-2016-7479	REPORT
	https://ubuntu.com/security/CVE-2016-9137	REPORT
	https://ubuntu.com/security/CVE-2016-9935	REPORT
	https://ubuntu.com/security/CVE-2016-9936	REPORT
	https://ubuntu.com/security/CVE-2016-10158	REPORT
	https://ubuntu.com/security/CVE-2016-10159	REPORT
	https://ubuntu.com/security/CVE-2016-10160	REPORT
	https://ubuntu.com/security/CVE-2016-10161	REPORT
	https://ubuntu.com/security/CVE-2016-10162	REPORT
	https://ubuntu.com/security/CVE-2017-5340	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2016-7479",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9137",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9935",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9936",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-10158",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-10159",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-10160",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-10161",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-10162",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-5340",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libapache2-mod-php7.0",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "libphp7.0-embed",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-bcmath",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-bz2",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-cgi",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-cli",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-common",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-curl",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-dba",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-enchant",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-fpm",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-gd",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-gmp",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-imap",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-interbase",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-intl",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-json",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-ldap",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-mbstring",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-mcrypt",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-mysql",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-odbc",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-opcache",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-pgsql",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-phpdbg",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-pspell",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-readline",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-recode",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-snmp",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-soap",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-sqlite3",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-sybase",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-tidy",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-xml",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-xmlrpc",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-xsl",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          },
          {
            "binary_name": "php7.0-zip",
            "binary_version": "7.0.15-0ubuntu0.16.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "php7.0",
        "purl": "pkg:deb/ubuntu/php7.0@7.0.15-0ubuntu0.16.04.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.15-0ubuntu0.16.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.1-5",
        "7.0.1-6",
        "7.0.2-1",
        "7.0.2-3",
        "7.0.2-4",
        "7.0.2-5",
        "7.0.3-2",
        "7.0.3-3",
        "7.0.3-9ubuntu1",
        "7.0.4-5ubuntu1",
        "7.0.4-5ubuntu2",
        "7.0.4-7ubuntu1",
        "7.0.4-7ubuntu2",
        "7.0.4-7ubuntu2.1",
        "7.0.8-0ubuntu0.16.04.1",
        "7.0.8-0ubuntu0.16.04.2",
        "7.0.8-0ubuntu0.16.04.3",
        "7.0.13-0ubuntu0.16.04.1",
        "7.0.15-0ubuntu0.16.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-7479)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-9137)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-9935)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-9936)\n\nIt was discovered that PHP incorrectly handled certain EXIF data. A remote\nattacker could use this issue to cause PHP to crash, resulting in a denial\nof service. (CVE-2016-10158)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash or consume\nresources, resulting in a denial of service. (CVE-2016-10159)\n\nIt was discovered that PHP incorrectly handled certain PHAR archives. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2016-10160)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service. (CVE-2016-10161)\n\nIt was discovered that PHP incorrectly handled unserializing certain\nwddxPacket XML documents. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service. (CVE-2016-10162)\n\nIt was discovered that PHP incorrectly handled certain invalid objects when\nunserializing data. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2017-5340)\n",
  "id": "USN-3211-1",
  "modified": "2026-04-22T07:36:34Z",
  "published": "2017-02-23T16:28:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3211-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-7479"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9137"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9935"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9936"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10158"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10159"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10160"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10161"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10162"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-5340"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "php7.0 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2016-7479",
    "UBUNTU-CVE-2016-9137",
    "UBUNTU-CVE-2016-9935",
    "UBUNTU-CVE-2016-9936",
    "UBUNTU-CVE-2016-10158",
    "UBUNTU-CVE-2016-10159",
    "UBUNTU-CVE-2016-10160",
    "UBUNTU-CVE-2016-10161",
    "UBUNTU-CVE-2016-10162",
    "UBUNTU-CVE-2017-5340"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2016-9936

Vulnerability from osv_ubuntu

CVE-2016-9936 (GCVE-0-2016-9936)

usn-3211-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature