Description
ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.
Remediation
References
Related Vulnerabilities
WordPress Plugin Poll, Survey, Form & Quiz Maker by OpinionStage Cross-Site Scripting (19.6.24)
WordPress Plugin Bongolive SMS Cross-Site Scripting (1.0.5)
Django Exposure of Resource to Wrong Sphere Vulnerability (CVE-2021-45116)
WebERP Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2020-22474)
OpenSSL NULL Pointer Dereference Vulnerability (CVE-2016-7053)