Description
ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | php7.0 | 7.0.27-0+deb9u1 | DSA-4080-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | php7.0 | 7.0.25-0ubuntu0.16.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-php70-php +29 | 7.0.27-1.el6 | RHSA-2018:1296 |
| RHEL 3 | rh-php71-php +27 | 7.1.30-1.el7 | RHSA-2019:2519 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | php7 | 7.0.7-50.18.1 | SUSE-SU-2017:2468-1 |
| SLES 12 SP2 | php7 | 7.0.7-50.18.1 | SUSE-SU-2017:2468-1 |
| SLES 12 | php7 | 7.0.7-50.18.1 | SUSE-SU-2017:2468-1 |
Advisories 4
- RHSA-2019:2519 Red Hat Security Advisory: rh-php71-php security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:1296 Red Hat Security Advisory: rh-php70-php security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-4080-1 php7.0 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2017:2468-1 Security update for php7 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 100427 vdb-entry
- RHSA-2018:1296 vendor-advisory
- https://github.com/php/php-src/commit/1a23ebc1fff59bf480ca92963b36eba5c1b904c4
- https://security.netapp.com/advisory/ntap-20180112-0001/
- https://bugs.php.net/bug.php?id=74103
- DSA-4080 vendor-advisory
- http://php.net/ChangeLog-7.php
- GLSA-201709-21 vendor-advisory
- RHSA-2019:2519 vendor-advisory