CVE-2016-9935HIGH
Description
The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document.
References
http://lists.opensuse.org/opensuse-updates/2016-12/msg00142.html
http://lists.opensuse.org/opensuse-updates/2017-01/msg00034.html
http://lists.opensuse.org/opensuse-updates/2017-01/msg00054.html
http://www.debian.org/security/2016/dsa-3737
http://www.openwall.com/lists/oss-security/2016/12/12/2
http://www.php.net/ChangeLog-5.php
http://www.php.net/ChangeLog-7.php
http://www.securityfocus.com/bid/94846
https://access.redhat.com/errata/RHSA-2018:1296
https://bugs.php.net/bug.php?id=73631
https://github.com/php/php-src/commit/66fd44209d5ffcb9b3d1bc1b9fd8e35b485040c0
Details
Source: MITRE
Published: 2017-01-04
Updated: 2018-05-04
Type: CWE-125
Risk Information
CVSS v2.0
Base Score: 7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 10
Severity: HIGH
CVSS v3.0
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 3.9
Severity: CRITICAL
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* versions up to 5.6.28 (inclusive)
cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:php:php:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:php:php:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:php:php:7.0.11:*:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 137966 | EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2020-1747) | Nessus | Huawei Local Security Checks | critical |
| 132184 | EulerOS 2.0 SP3 : php (EulerOS-SA-2019-2649) | Nessus | Huawei Local Security Checks | critical |
| 131592 | EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438) | Nessus | Huawei Local Security Checks | critical |
| 130683 | EulerOS 2.0 SP5 : php (EulerOS-SA-2019-2221) | Nessus | Huawei Local Security Checks | critical |
| 98838 | PHP 7.0.x < 7.0.14 php_wddx_push_element() Function Empty Boolean Element Decoding RCE | Web Application Scanning | Component Vulnerability | high |
| 98819 | PHP 5.6.x < 5.6.29 Multiple Vulnerabilities | Web Application Scanning | Component Vulnerability | high |
| 119990 | SUSE SLES12 Security Update : php5 (SUSE-SU-2017:0038-1) | Nessus | SuSE Local Security Checks | high |
| 119989 | SUSE SLES12 Security Update : php7 (SUSE-SU-2017:0017-1) | Nessus | SuSE Local Security Checks | high |
| 99134 | macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy) | Nessus | MacOS X Local Security Checks | critical |
| 97566 | openSUSE Security Update : php5 (openSUSE-2017-308) | Nessus | SuSE Local Security Checks | high |
| 97521 | Ubuntu 16.04 LTS / 16.10 : php7.0 regression (USN-3211-2) | Nessus | Ubuntu Local Security Checks | high |
| 97384 | Ubuntu 16.04 LTS / 16.10 : php7.0 vulnerabilities (USN-3211-1) | Nessus | Ubuntu Local Security Checks | high |
| 97272 | GLSA-201702-29 : PHP: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 97190 | Ubuntu 12.04 LTS / 14.04 LTS : php5 vulnerabilities (USN-3196-1) | Nessus | Ubuntu Local Security Checks | high |
| 97052 | Debian DLA-818-1 : php5 security update | Nessus | Debian Local Security Checks | critical |
| 96806 | Amazon Linux AMI : php70 (ALAS-2017-788) | Nessus | Amazon Linux Local Security Checks | high |
| 96805 | Amazon Linux AMI : php56 (ALAS-2017-787) | Nessus | Amazon Linux Local Security Checks | high |
| 96431 | SUSE SLES11 Security Update : php53 (SUSE-SU-2017:0109-1) | Nessus | SuSE Local Security Checks | high |
| 96381 | openSUSE Security Update : php5 (openSUSE-2017-62) | Nessus | SuSE Local Security Checks | high |
| 96380 | openSUSE Security Update : php7 (openSUSE-2017-61) | Nessus | SuSE Local Security Checks | high |
| 96221 | FreeBSD : PHP -- multiple vulnerabilities (6972668d-cdb7-11e6-a9a5-b499baebfeaf) | Nessus | FreeBSD Local Security Checks | high |
| 96130 | openSUSE Security Update : php5 (openSUSE-2016-1505) | Nessus | SuSE Local Security Checks | high |
| 96016 | Debian DSA-3737-1 : php5 - security update | Nessus | Debian Local Security Checks | high |
| 95875 | PHP 7.0.x < 7.0.14 Multiple Vulnerabilities | Nessus | CGI abuses | high |
| 95874 | PHP 5.6.x < 5.6.29 Multiple Vulnerabilities | Nessus | CGI abuses | high |
| 95725 | Slackware 14.0 / 14.1 / 14.2 / current : php (SSA:2016-347-03) | Nessus | Slackware Local Security Checks | high |