CVE-2016-5772: Double Free
Double free vulnerability in the phpwddxprocessdata function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddxdeserialize call.
Other sources
Fixed bug (Double Free Courruption in wddxdeserialize). (CVE-2016-5772)
— PHP
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5772?
CVE-2016-5772 is considered to have a high severity due to its potential for causing denial of service and executing arbitrary code.
How do I fix CVE-2016-5772?
To fix CVE-2016-5772, upgrade PHP to version 5.5.37, 5.6.23, or 7.0.8 or later.
Which versions of PHP are affected by CVE-2016-5772?
CVE-2016-5772 affects PHP versions prior to 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8.
What is the impact of CVE-2016-5772 on PHP applications?
The impact of CVE-2016-5772 includes potential application crashes and the risk of remote code execution when processing crafted XML data.
What components are specifically vulnerable in CVE-2016-5772?
The vulnerability exists in the php_wddx_process_data function within the WDDX extension of PHP.