CVE-2016-7418: Buffer Overflow
A null pointer vulnerability was found in function wddxdeserialize.
Upstream bug:
https://bugs.php.net/bug.php?id=73065
Upstream patch:
https://github.com/php/php-src/commit/c4cca4c20e75359c9a13a1f9a36cb7b4e9601d29?w=1
CVE assignment:
http://seclists.org/oss-sec/2016/q3/518
Other sources
Fixed bug (Out-Of-Bounds Read in phpwddxpushelement). (CVE-2016-7418)
— PHP
The phpwddxpushelement function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service (invalid pointer access and out-of-bounds read) or possibly have unspecified other impact via an incorrect boolean element in a wddxPacket XML document, leading to mishandling in a wddxdeserialize call.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7418?
CVE-2016-7418 has been classified as a denial of service vulnerability due to invalid pointer access and out-of-bounds read.
How do I fix CVE-2016-7418?
To mitigate CVE-2016-7418, upgrade PHP to version 5.6.26 or 7.0.11 or later.
What versions of PHP are affected by CVE-2016-7418?
CVE-2016-7418 affects PHP versions prior to 5.6.26 and prior to 7.0.11.
Can CVE-2016-7418 lead to data loss?
CVE-2016-7418 does not directly indicate data loss but may cause service disruption due to denial of service.
Who is the vendor associated with CVE-2016-7418?
The vendor associated with CVE-2016-7418 is PHP, which oversees the PHP programming language.