PT-2017-4175 · Php+2 · Php+2

Taoguangchen · Published 2016-12-13 · Updated 2018-05-04 · CVE-2016-9934

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.28 PHP versions 7.x prior to 7.0.13

Description The issue is related to a NULL pointer dereference in the ext/wddx/wddx.c component of the PHP interpreter. This can be exploited by remote attackers using crafted serialized data in a wddxPacket XML document, such as a PDORow string, to cause a denial of service.

Recommendations For PHP versions prior to 5.6.28, update to version 5.6.28 or later. For PHP versions 7.x prior to 7.0.13, update to version 7.0.13 or later.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2022-02418

CVE-2016-9934

DLA-818-1

DSA-3732-1

DSA-3732-2

MGASA-2016-0422

RHSA-2018:1296

SUSE-SU-2017:0017-1

SUSE-SU-2017:0038-1

SUSE-SU-2017:0109-1

USN-3196-1

Affected Products

Php

Suse

Ubuntu

References · 51

• https://github.com/php/php-src/commit/6045de69c7dedcba3eadf7c4bba424b19c81d00d · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02418 · Security Note
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2017-01/msg00054.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1296 · Vendor Advisory
• https://bugs.php.net/bug.php?id=73331 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3196-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9934 · Security Note
• https://ubuntu.com/security/CVE-2016-7478 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9934 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3732-1 · Vendor Advisory
• http://php.net/ChangeLog-7.php · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9934 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7479 · Vendor Advisory
• http://php.net/ChangeLog-5.php · Vendor Advisory