high7.5
CVE-2018-15503
The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process.
Impact
The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker can craft a serialized object to exploit this vulnerability and cause a SEGV.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Swoole | Swoole | Version 4.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/swoole/swoole-src/commit/4cdbce5d9bf2fe596bb6acd7d6611f9e8c253a76
- https://github.com/swoole/swoole-src/issues/1882
- https://x-c3ll.github.io/posts/swoole-deserialization-cve-2018-15503/
- https://github.com/swoole/swoole-src/commit/4cdbce5d9bf2fe596bb6acd7d6611f9e8c253a76
- https://github.com/swoole/swoole-src/issues/1882
- https://x-c3ll.github.io/posts/swoole-deserialization-cve-2018-15503/