First published: Mon Sep 12 2016(Updated: )
The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
PHP | <7.0.10 | 7.0.10 |
PHP | =7.0.0 | |
PHP | =7.0.1 | |
PHP | =7.0.2 | |
PHP | =7.0.3 | |
PHP | =7.0.4 | |
PHP | =7.0.5 | |
PHP | =7.0.6 | |
PHP | =7.0.7 | |
PHP | =7.0.8 | |
PHP | =7.0.9 | |
PHP | <=5.6.24 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2016-7129 is classified as a denial of service vulnerability that can result in segmentation fault.
To fix CVE-2016-7129, upgrade PHP to version 7.0.10 or later, or to any version greater than 5.6.25.
CVE-2016-7129 affects PHP versions prior to 5.6.25 and all 7.x versions before 7.0.10.
CVE-2016-7129 can be exploited by passing an invalid ISO 8601 time value to the php_wddx_process_data function.
While primarily a denial of service issue, CVE-2016-7129 may also have unspecified impacts if exploited.