CVE-2016-3141
CriticalSummary
A use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) by triggering a wddx_deserialize call on XML data containing a crafted var element.
Risk Assessment
Organizations may experience application crashes and potential service availability issues, leading to disruptions in operations. There is also a risk of unspecified impact on systems that could be exploited by attackers.
Recommendation
It is recommended to upgrade PHP to version 5.5.33 or 5.6.19 and later to mitigate this vulnerability. Additionally, monitoring and analyzing application logs for potential attack attempts is advisable.
Original NVD description (English source)
Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.