CVE-2016-5772

high-risk

Published 2016-08-07

Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.

Do I need to act?

15.9% chance of exploitation in next 30 days

EPSS score — higher than 84% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Fix available

Upgrade to: d5747a70cf612e653b0e56dfa50efb29bbba273d, 961e562d1b7e7d67c7370022a167938641d607ea, a36407215f69ba2debf77933dcb3faa0c3ba2d04, a44c89e8af7c2410f4bfc5e097be2a5d0639a60c

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (7)

Php

Linux Enterprise Debuginfo

Opensuse

Linux Enterprise Software Development Kit

Debian Linux

Leap

Linux Enterprise Server

Affected Vendors

Suse Php Debian Opensuse

References (28)

Patch http://github.com/php/php-src/commit/a44c89e8af7c2410f4bfc5e097be2a5d0639a60c?w=...

Broken Link http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html

Mailing List http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html

Patch http://php.net/ChangeLog-5.php

Release Notes http://php.net/ChangeLog-7.php

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-2750.html

Third Party Advisory http://www.debian.org/security/2016/dsa-3618

Mailing List http://www.openwall.com/lists/oss-security/2016/06/23/4

Third Party Advisory http://www.securityfocus.com/bid/91398

Exploit https://bugs.php.net/bug.php?id=72340

Third Party Advisory https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c...

Third Party Advisory https://support.apple.com/HT207170

Patch http://github.com/php/php-src/commit/a44c89e8af7c2410f4bfc5e097be2a5d0639a60c?w=...

Broken Link http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00004.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00025.html

Mailing List http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html

Patch http://php.net/ChangeLog-5.php

and 8 more references

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 13/34 · Low

Exposure 14/34 · Moderate