CVE-2016-7129
CriticalSummary
The php_wddx_process_data function in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value.
Risk Assessment
Attackers may exploit this vulnerability to disrupt application functionality, potentially leading to downtime and loss of service availability.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor applications for invalid time values.
Original NVD description (English source)
The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.