CVE-2016-9934: Null Pointer Dereference
ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.
Other sources
Fixed bug (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow). (CVE-2016-9934)
— PHP
Null pointer dereference in WDDX Packet Deserialization with PDORow object was found.
Upstream bug:
https://bugs.php.net/bug.php?id=73331
Upstream patch:
https://github.com/php/php-src/commit/6045de69c7dedcba3eadf7c4bba424b19c81d00d
CVE assignment:
http://seclists.org/oss-sec/2016/q4/658
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9934?
CVE-2016-9934 has a severity level that may lead to a denial of service due to NULL pointer dereference.
How do I fix CVE-2016-9934?
To fix CVE-2016-9934, upgrade to PHP version 5.6.28 or 7.0.13 and later.
Which versions of PHP are affected by CVE-2016-9934?
CVE-2016-9934 affects PHP versions earlier than 5.6.28 and 7.x versions before 7.0.13.
Is it possible to exploit CVE-2016-9934 remotely?
Yes, CVE-2016-9934 can be exploited remotely by sending crafted serialized data in a wddxPacket XML document.
What type of impact can CVE-2016-9934 have on a server?
CVE-2016-9934 can cause a denial of service, rendering the server temporarily unavailable.