KLA10930 Denial of service vulnerability in PHP

An unspecified vulnerability was found in PHP before 5.6.29 and 7.x before 7.0.14. By exploiting this vulnerability malicious users can cause a denial of service. This vulnerability can be exploited remotely via an empty boolean element in a wddxPacket XML document.

Technical details

This vulnerability occurs in the php_wddx_push_element function in ext/wddx/wddx.c.

Original advisories

PHP 7 ChangeLog

PHP 5 ChangeLog

Related products

PHP

CVE list

CVE-2016-9935 critical

Solution

Update to the latest version

Download PHP

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• PHP before 5.6.29PHP 7.x before 7.0.14