CVE-2016-4539
CriticalSummary
The xml_parse_into_struct function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service through crafted XML data, leading to parser errors.
Risk Assessment
Attackers can exploit this vulnerability to crash applications, potentially leading to service downtime and financial losses.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor applications for unauthorized exploitation attempts.
Original NVD description (English source)
The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument, leading to a parser level of zero.