CVE Catalog
CVE-2016-9935
CriticalSummary
The php_wddx_push_element function in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service via out-of-bounds read and memory corruption using an empty boolean element in a wddxPacket XML document.
Risk Assessment
Attackers can cause service outages, potentially leading to application downtime and data integrity issues.
Recommendation
It is recommended to update PHP to the latest version to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document.