CVE-2016-9934

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-updates/2016-12/msg00142.html
http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html
http://lists.opensuse.org/opensuse-updates/2017-01/msg00054.html
http://www.openwall.com/lists/oss-security/2016/12/12/2Third Party Advisory
http://www.php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
http://www.php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/94845
https://access.redhat.com/errata/RHSA-2018:1296
https://bugs.php.net/bug.php?id=73331Vendor Advisory
https://github.com/php/php-src/commit/6045de69c7dedcba3eadf7c4bba424b19c81d00dVendor Advisory
http://lists.opensuse.org/opensuse-updates/2016-12/msg00142.html
http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html
http://lists.opensuse.org/opensuse-updates/2017-01/msg00054.html
http://www.openwall.com/lists/oss-security/2016/12/12/2Third Party Advisory
http://www.php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
http://www.php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/94845
https://access.redhat.com/errata/RHSA-2018:1296
https://bugs.php.net/bug.php?id=73331Vendor Advisory
https://github.com/php/php-src/commit/6045de69c7dedcba3eadf7c4bba424b19c81d00dVendor Advisory

Timeline

Published: Jan 4, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-99359.8The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial o CVE-2016-99369.8The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-afte CVE-2016-99377.5An issue was discovered in Asterisk Open Source 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1. If an SDP offer or answer is rece CVE-2016-99385.3An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x CVE-2016-99397.5Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block ba CVE-2016-99419.8Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (a CVE-2016-99429.8Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (appl CVE-2016-99497.8An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python c CVE-2016-99507.8An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fiel CVE-2016-99516.5An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmd CVE-2016-99528.1The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS ba CVE-2016-99539.8The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS ba