CVE-2016-7132

high-risk
Published 2016-09-12

ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.

Do I need to act?

!
14.9% chance of exploitation in next 30 days
EPSS score — higher than 85% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (11)

Php
Php
Php
Php
Php
Php
Php
Php
Php
Php
Php

Affected Vendors

Php

References (22)

Mailing List http://openwall.com/lists/oss-security/2016/09/02/9
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-2750.html
Release Notes http://www.php.net/ChangeLog-5.php
Release Notes http://www.php.net/ChangeLog-7.php
Third Party Advisory http://www.securityfocus.com/bid/92767
Third Party Advisory http://www.securitytracker.com/id/1036680
Exploit https://bugs.php.net/bug.php?id=72799
Patch https://github.com/php/php-src/commit/0c8a2a2cd1056b7dc403eacb5d2c0eec6ce47c6f
Issue Tracking https://github.com/php/php-src/commit/a14fdb9746262549bbbb96abb87338bacd147e1b?w...
Third Party Advisory https://security.gentoo.org/glsa/201611-22
Third Party Advisory https://www.tenable.com/security/tns-2016-19
Mailing List http://openwall.com/lists/oss-security/2016/09/02/9
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-2750.html
Release Notes http://www.php.net/ChangeLog-5.php
Release Notes http://www.php.net/ChangeLog-7.php
Third Party Advisory http://www.securityfocus.com/bid/92767
Third Party Advisory http://www.securitytracker.com/id/1036680
Exploit https://bugs.php.net/bug.php?id=72799
Patch https://github.com/php/php-src/commit/0c8a2a2cd1056b7dc403eacb5d2c0eec6ce47c6f
Issue Tracking https://github.com/php/php-src/commit/a14fdb9746262549bbbb96abb87338bacd147e1b?w...
and 2 more references
54
/ 100
high-risk
Severity 26/34 · High
Exploitability 12/34 · Low
Exposure 16/34 · Moderate