CVE-2016-7130 Null dereference in n/a
Remote attackers can cause a denial of service via a NULL pointer dereference in the PHP WDDX extension when processing invalid base64 binary values.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7130?
CVE-2016-7130 is a high-severity vulnerability in Php Php, published on 12 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.
Weakness: CWE-476
Which versions are affected by CVE-2016-7130?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2016-7130?
Upgrade to a fixed version.
Is CVE-2016-7130 being exploited?
There is no known exploitation of CVE-2016-7130 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-fxph-98fm-4qqc, UBUNTU-CVE-2016-7130.