VIR Vulnerability Intelligence Relay

CVE-2016-9138

critical
Published 2017-01-04 · Modified 2026-05-06
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
7.5
VIR risk
9.8

Description

PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data, as demonstrated by Exception::__toString with DateInterval::__wakeup.

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2016-9138.html

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://bugs.php.net/bug.php?id=73147

vendor Authored 2026-05-27

Vendor advisory: arch — https://security.archlinux.org/ASA-201611-19

OS impact
OSVersionStatusFixed in
suse slesaffected
arch archfixed7.0.13-1

Application impact
VendorProductVersionsFixed
phpphp{"endIncluding":"5.6.27"}
phpphp7.0.0
phpphp7.0.1
phpphp7.0.2
phpphp7.0.3
phpphp7.0.4
phpphp7.0.5
phpphp7.0.6
phpphp7.0.7
phpphp7.0.8
phpphp7.0.9
phpphp7.0.10
phpphp7.0.11
phpphp7.0.12

References

CWEs

CWE-416

Verify integrity in audit chain (admin only). AS-IS.