CVE-2016-9137

Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.

• CWE-416

• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0e6fe3a4c96be2d3e88389a5776f878021b4c59f
• http://www.debian.org/security/2016/dsa-3698
• http://www.openwall.com/lists/oss-security/2016/11/01/2Third Party Advisory
• http://www.php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
• http://www.php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
• http://www.securityfocus.com/bid/93577Third Party Advisory, VDB Entry
• https://bugs.php.net/bug.php?id=73147Exploit, Vendor Advisory
• https://www.tenable.com/security/tns-2016-19
• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0e6fe3a4c96be2d3e88389a5776f878021b4c59f
• http://www.debian.org/security/2016/dsa-3698
• http://www.openwall.com/lists/oss-security/2016/11/01/2Third Party Advisory
• http://www.php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
• http://www.php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
• http://www.securityfocus.com/bid/93577Third Party Advisory, VDB Entry
• https://bugs.php.net/bug.php?id=73147Exploit, Vendor Advisory
• https://www.tenable.com/security/tns-2016-19

Published

Jan 4, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9130Revive Adserver before 3.2.3 suffers from Persistent XSS. A …
• CVE-2016-9131named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-…7.5
• CVE-2016-9132In Botan 1.8.0 through 1.11.33, when decoding BER data an in…
• CVE-2016-9134Exponent CMS 2.3.9 suffers from a SQL injection vulnerabilit…
• CVE-2016-9135Exponent CMS 2.3.9 suffers from a SQL injection vulnerabilit…
• CVE-2016-9136Artifex Software, Inc. MuJS before a0ceaf5050faf419401fe1b83…7.5
• CVE-2016-9138PHP through 5.6.27 and 7.x through 7.0.12 mishandles propert…
• CVE-2016-9139Cross-site scripting (XSS) vulnerability in Open Ticket Requ…
• CVE-2016-9140Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-9141Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9142Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9143Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…