ID:6435 - Exploit for Use-after-free error in PHP - CVE-2016-5773

Vulnerability identifier: #VU3613

Vulnerability risk: High

CVE-ID: CVE-2016-5773

CWE-ID: CWE-416

Exploitation vector: Remote access

Vulnerable software:
PHP

https://www.exploit-db.com/exploits/40414/

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to use-after-free in GC algorithm and unserialize. A remote attacker can create a specially crafted zval object and exploit the PHP process by taking over the EIP/RIP.

Successful exploitation of this vulnerability results in complete control over the vulnerable web application and execute arbitrary PHP code on the target system.

Update to version 5.6.23.