fkie_cve-2016-9935
Vulnerability from fkie_nvd
Published
2017-01-04 20:59
Modified
2024-11-21 03:02
Severity ?
Summary
The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document.
References
Impacted products
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", matchCriteriaId: "390EC369-28E0-4708-B909-B4F271B319DE", versionEndIncluding: "5.6.28", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*", matchCriteriaId: "DB6890AF-8A0A-46EE-AAD5-CF9AAE14A321", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*", matchCriteriaId: "6B90B947-7B54-47F3-9637-2F4AC44079EE", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*", matchCriteriaId: "35848414-BD5D-4164-84DC-61ABBB1C4152", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*", matchCriteriaId: "2B1F8402-8551-4F66-A9A7-81D472AB058E", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*", matchCriteriaId: "7A773E8E-48CD-4D35-A0FD-629BD9334486", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*", matchCriteriaId: "FC492340-79AF-4676-A161-079A97EC6F0C", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*", matchCriteriaId: "F1C2D8FE-C380-4B43-B634-A3DBA4700A71", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*", matchCriteriaId: "3EB58393-0C10-413C-8D95-6BAA8BC19A1B", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.8:*:*:*:*:*:*:*", matchCriteriaId: "751F51CA-9D88-4971-A6EC-8C0B72E8E22B", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.9:*:*:*:*:*:*:*", matchCriteriaId: "37B74118-8FC2-44CB-9673-A83DF777B2E6", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.10:*:*:*:*:*:*:*", matchCriteriaId: "4D56A200-1477-40DA-9444-CFC946157C69", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.11:*:*:*:*:*:*:*", matchCriteriaId: "FD0D1CCC-A857-4C15-899E-08F9255CEE34", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.12:*:*:*:*:*:*:*", matchCriteriaId: "6745CC43-2836-4CD8-848F-EEA08AE9D5AC", vulnerable: true, }, { criteria: "cpe:2.3:a:php:php:7.0.13:*:*:*:*:*:*:*", matchCriteriaId: "7BEB6696-14F9-4D9B-9974-B682FFBB828E", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document.", }, { lang: "es", value: "La función php_wddx_push_element en ext/wddx/wddx.c en PHP en versiones anteriores a 5.6.29 y 7.x en versiones anteriores a 7.0.14 permite a atacantes remotos provocar una denegación de servicio (lectura fuera de rango y corrupción de memoria) o posiblemente tener otro impacto no especificado de un elemento booleano vacío en un documento wddxPacket XML.", }, ], id: "CVE-2016-9935", lastModified: "2024-11-21T03:02:02.340", metrics: { cvssMetricV2: [ { acInsufInfo: true, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], cvssMetricV30: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "nvd@nist.gov", type: "Primary", }, ], }, published: "2017-01-04T20:59:00.573", references: [ { source: "cve@mitre.org", url: "http://lists.opensuse.org/opensuse-updates/2016-12/msg00142.html", }, { source: "cve@mitre.org", url: "http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html", }, { source: "cve@mitre.org", url: "http://lists.opensuse.org/opensuse-updates/2017-01/msg00054.html", }, { source: "cve@mitre.org", url: "http://www.debian.org/security/2016/dsa-3737", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.openwall.com/lists/oss-security/2016/12/12/2", }, { source: "cve@mitre.org", tags: [ "Release Notes", "Vendor Advisory", ], url: "http://www.php.net/ChangeLog-5.php", }, { source: "cve@mitre.org", tags: [ "Release Notes", "Vendor Advisory", ], url: "http://www.php.net/ChangeLog-7.php", }, { source: "cve@mitre.org", url: "http://www.securityfocus.com/bid/94846", }, { source: "cve@mitre.org", url: "https://access.redhat.com/errata/RHSA-2018:1296", }, { source: "cve@mitre.org", tags: [ "Vendor Advisory", ], url: "https://bugs.php.net/bug.php?id=73631", }, { source: "cve@mitre.org", tags: [ "Patch", "Vendor Advisory", ], url: "https://github.com/php/php-src/commit/66fd44209d5ffcb9b3d1bc1b9fd8e35b485040c0", }, { source: "cve@mitre.org", url: "https://security.gentoo.org/glsa/201702-29", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-updates/2016-12/msg00142.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://lists.opensuse.org/opensuse-updates/2017-01/msg00054.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.debian.org/security/2016/dsa-3737", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www.openwall.com/lists/oss-security/2016/12/12/2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Release Notes", "Vendor Advisory", ], url: "http://www.php.net/ChangeLog-5.php", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Release Notes", "Vendor Advisory", ], url: "http://www.php.net/ChangeLog-7.php", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.securityfocus.com/bid/94846", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://access.redhat.com/errata/RHSA-2018:1296", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://bugs.php.net/bug.php?id=73631", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Vendor Advisory", ], url: "https://github.com/php/php-src/commit/66fd44209d5ffcb9b3d1bc1b9fd8e35b485040c0", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://security.gentoo.org/glsa/201702-29", }, ], sourceIdentifier: "cve@mitre.org", vulnStatus: "Modified", weaknesses: [ { description: [ { lang: "en", value: "CWE-125", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.