remicollet/php-src-security

CVE-2018-19396

Closed this issue · 5 comments

YumeMichi commented

Sir, do we need fix this in php 5.6? Some anti virus softwares (NSFOCUS etc.) report it as a high risk vulnerability.

https://www.cvedetails.com/cve/CVE-2018-19396/

Thank you for your work!

remicollet commented

serialize / unserialize bug are not considered as security issue
See https://www.php.net/manual/en/function.unserialize.php

unserialize is unsecured by design.

This CVE was not affected by PHP project, see https://bugs.php.net/bug.php?id=77177

remicollet commented

Notice: bug was fixed in 7.2.14 in COM extension (so Windows only)

As I don't have any Windows env (and don't use it), need someone to work on it, btw don't think it worth the work.

  • 👍1
Jan-E commented

For anyone interested. It was fixed in 7.2.14 by @cmb69
php/php-src@115ee49