CVE-2016-7125 log
| Source |
|
| Severity | High |
| Remote | Yes |
| Type | Access restriction bypass |
| Description | It has been discovered that ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-152 | php | 7.0.9-1 | 7.0.10-1 | High | Fixed |
| References |
|---|
https://bugs.php.net/bug.php?id=72681 https://github.com/php/php-src/commit/8763c6090d627d8bb0ee1d030c30e58f406be9ce?w=1 http://www.php.net/ChangeLog-7.php |