CVE-2016-7413
CriticalSummary
A use-after-free vulnerability in the wddx_stack_destroy function in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call.
Risk Assessment
Organizations may be exposed to attacks that lead to denial of service, impacting application availability. Additionally, there is a risk of unspecified consequences that may affect system integrity.
Recommendation
It is recommended to update PHP to version 5.6.26 or 7.0.11 and later to mitigate this vulnerability. Also, monitor applications using wddx to minimize the risk of attacks.
Original NVD description (English source)
Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call.