PT-2017-4175 · Php+2 · Php+2

Taoguangchen · Publicado 2016-12-13 · Atualizado 2018-05-04 · CVE-2016-9934

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.28 PHP versions 7.x prior to 7.0.13

Description The issue is related to a NULL pointer dereference in the ext/wddx/wddx.c component of the PHP interpreter. This can be exploited by remote attackers using crafted serialized data in a wddxPacket XML document, such as a PDORow string, to cause a denial of service.

Recommendations For PHP versions prior to 5.6.28, update to version 5.6.28 or later. For PHP versions 7.x prior to 7.0.13, update to version 7.0.13 or later.

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

BDU:2022-02418

CVE-2016-9934

DLA-818-1

DSA-3732-1

DSA-3732-2

MGASA-2016-0422

RHSA-2018:1296

SUSE-SU-2017:0017-1

SUSE-SU-2017:0038-1

SUSE-SU-2017:0109-1

USN-3196-1

Produtos afetados

Php

Suse

Ubuntu

Referências · 51

• https://github.com/php/php-src/commit/6045de69c7dedcba3eadf7c4bba424b19c81d00d · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2022-02418 · Nota de Segurança
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html · Aviso do Fabricante
• https://suse.com/support/update/announcement/2017/suse-su-20170017-1 · Nota
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00054.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:1296 · Aviso do Fabricante
• https://bugs.php.net/bug.php?id=73331 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3196-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-9934 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-7478 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9934 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3732-1 · Aviso do Fabricante
• http://php.net/ChangeLog-7.php · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/12/12/2 · Nota
• https://osv.dev/vulnerability/CVE-2016-9934 · Aviso do Fabricante