CVE-2016-7130

High

Published: 12/09/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The php_wddx_pop_element function in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service via NULL pointer dereference, leading to application crash. This issue occurs with an invalid base64 binary value in a wddxPacket XML document.

Risk Assessment

Attackers can exploit this vulnerability to disrupt application functionality, potentially leading to downtime and loss of service availability. There may also be unspecified other impacts.

Recommendation

It is recommended to upgrade PHP to version 5.6.25 or 7.0.10 and to monitor applications for invalid input data. Additionally, implementing extra security measures against DoS attacks is advisable.

Other vulnerabilities in PHP (przed wersją 5.6.25 oraz 7.x przed wersją 7.0.10)

CVE-2016-7132High
In PHP before 5.6.25 and 7.x before 7.0.10, a vulnerability allows remote attackers to cause application crashes via an invalid wddxPacket XML document during a wddx_deserialize call. This is demonstrated by a stray element inside a boolean element, leading to NULL pointer dereference.

Original NVD description (English source)

The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.