Description
ext/standard/var_unserializer.re in PHP 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a heap use after free while unserializing untrusted data, related to the zval_get_type function in Zend/zend_types.h. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | php7.0 | 7.0.27-0+deb9u1 | DSA-4080-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | rh-php70-php +29 | 7.0.27-1.el6 | RHSA-2018:1296 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | php7 | 7.0.7-50.18.1 | SUSE-SU-2017:2468-1 |
| SLES 12 SP2 | php7 | 7.0.7-50.18.1 | SUSE-SU-2017:2468-1 |
| SLES 12 | php7 | 7.0.7-50.18.1 | SUSE-SU-2017:2468-1 |
Advisories 3
- RHSA-2018:1296 Red Hat Security Advisory: rh-php70-php security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-4080-1 php7.0 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2017:2468-1 Security update for php7 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://bugs.php.net/bug.php?id=74101
- 100428 vdb-entry
- RHSA-2018:1296 vendor-advisory
- DSA-4080 vendor-advisory
- http://php.net/ChangeLog-7.php