description: The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.
problem types: missing data-type validation
affected:
{
product: PHP before 7.0.12
vendor: n/a
versions:
status: affected, version: PHP before 7.0.12
}