CVE-2016-7129: Input Validation
The phpwddxprocessdata function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddxdeserialize call that mishandles a dateTime element in a wddxPacket XML document.
Other sources
Fixed bug (wddxdeserialize allows illegal memory access). (CVE-2016-7129)
— PHP
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7129?
CVE-2016-7129 is classified as a denial of service vulnerability that can result in segmentation fault.
How do I fix CVE-2016-7129?
To fix CVE-2016-7129, upgrade PHP to version 7.0.10 or later, or to any version greater than 5.6.25.
Which PHP versions are affected by CVE-2016-7129?
CVE-2016-7129 affects PHP versions prior to 5.6.25 and all 7.x versions before 7.0.10.
What type of attack does CVE-2016-7129 exploit?
CVE-2016-7129 can be exploited by passing an invalid ISO 8601 time value to the php_wddx_process_data function.
Can CVE-2016-7129 lead to other security issues?
While primarily a denial of service issue, CVE-2016-7129 may also have unspecified impacts if exploited.