CVE-2016-7413 Use after free in n/a
Remote attackers can cause denial of service or potentially execute code via a malformed WDDX XML document in PHP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7413?
CVE-2016-7413 is a critical use after free vulnerability in Php Php, published on 17 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call.
Weakness: CWE-416
Which versions are affected by CVE-2016-7413?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2016-7413?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2016-7413 being exploited?
There is no known exploitation of CVE-2016-7413 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as ALPINE-CVE-2016-7413, GHSA-9m4c-2m8h-f93q, UBUNTU-CVE-2016-7413.