CVE-2016-3141 Use after free in n/a
Remote attackers can trigger a use-after-free in the PHP WDDX extension via crafted XML, causing denial of service or potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-3141?
CVE-2016-3141 is a critical use after free vulnerability in Apple Mac Os X, published on 31 Mar 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.
Weakness: CWE-119
Which versions are affected by CVE-2016-3141?
It affects 2 products.
Products include Apple Mac Os X, Php Php.
How do I fix CVE-2016-3141?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2016-3141 being exploited?
There is no known exploitation of CVE-2016-3141 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apple Mac Os X
Sources
Also known as GHSA-29c3-272h-2rcq, UBUNTU-CVE-2016-3141.