ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | amazon-linux-upgrade-php56amazon-linux-upgrade-php70 | Jan 27, 2017 | Jan 4, 2017 |
| Apple Osx Apachemodphp | apple-osx-upgrade-latest | Jan 24, 2017 | Jan 4, 2017 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jan 4, 2017 | |
| Debian | debian-upgrade-php5debian-upgrade-php7-0 | Dec 13, 2016 | Dec 13, 2016 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-phphuawei-euleros-2_0_sp2-upgrade-php-clihuawei-euleros-2_0_sp2-upgrade-php-commonhuawei-euleros-2_0_sp2-upgrade-php-gdhuawei-euleros-2_0_sp2-upgrade-php-ldaphuawei-euleros-2_0_sp2-upgrade-php-mysqlhuawei-euleros-2_0_sp2-upgrade-php-odbchuawei-euleros-2_0_sp2-upgrade-php-pdohuawei-euleros-2_0_sp2-upgrade-php-pgsqlhuawei-euleros-2_0_sp2-upgrade-php-processhuawei-euleros-2_0_sp2-upgrade-php-recodehuawei-euleros-2_0_sp2-upgrade-php-soaphuawei-euleros-2_0_sp2-upgrade-php-xmlhuawei-euleros-2_0_sp2-upgrade-php-xmlrpc | Dec 4, 2019 | Jan 4, 2017 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-phphuawei-euleros-2_0_sp3-upgrade-php-clihuawei-euleros-2_0_sp3-upgrade-php-commonhuawei-euleros-2_0_sp3-upgrade-php-gdhuawei-euleros-2_0_sp3-upgrade-php-ldaphuawei-euleros-2_0_sp3-upgrade-php-mysqlhuawei-euleros-2_0_sp3-upgrade-php-odbchuawei-euleros-2_0_sp3-upgrade-php-pdohuawei-euleros-2_0_sp3-upgrade-php-pgsqlhuawei-euleros-2_0_sp3-upgrade-php-processhuawei-euleros-2_0_sp3-upgrade-php-recodehuawei-euleros-2_0_sp3-upgrade-php-soaphuawei-euleros-2_0_sp3-upgrade-php-xmlhuawei-euleros-2_0_sp3-upgrade-php-xmlrpc | Dec 18, 2019 | Jan 4, 2017 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-phphuawei-euleros-2_0_sp5-upgrade-php-clihuawei-euleros-2_0_sp5-upgrade-php-commonhuawei-euleros-2_0_sp5-upgrade-php-gdhuawei-euleros-2_0_sp5-upgrade-php-ldaphuawei-euleros-2_0_sp5-upgrade-php-mysqlhuawei-euleros-2_0_sp5-upgrade-php-odbchuawei-euleros-2_0_sp5-upgrade-php-pdohuawei-euleros-2_0_sp5-upgrade-php-pgsqlhuawei-euleros-2_0_sp5-upgrade-php-processhuawei-euleros-2_0_sp5-upgrade-php-recodehuawei-euleros-2_0_sp5-upgrade-php-soaphuawei-euleros-2_0_sp5-upgrade-php-xmlhuawei-euleros-2_0_sp5-upgrade-php-xmlrpc | Nov 19, 2019 | Jan 4, 2017 | |
| Php | php-upgrade-5_6_28php-upgrade-7_0_13 | Jan 10, 2017 | Jan 4, 2017 | |
| Suse | — | suse-upgrade-apache2-mod_php5suse-upgrade-apache2-mod_php53suse-upgrade-apache2-mod_php7suse-upgrade-php5suse-upgrade-php5-bcmathsuse-upgrade-php5-bz2suse-upgrade-php5-calendarsuse-upgrade-php5-ctypesuse-upgrade-php5-curlsuse-upgrade-php5-dbasuse-upgrade-php5-develsuse-upgrade-php5-domsuse-upgrade-php5-enchantsuse-upgrade-php5-exifsuse-upgrade-php5-fastcgisuse-upgrade-php5-fileinfosuse-upgrade-php5-fpmsuse-upgrade-php5-ftpsuse-upgrade-php5-gdsuse-upgrade-php5-gettextsuse-upgrade-php5-gmpsuse-upgrade-php5-iconvsuse-upgrade-php5-imapsuse-upgrade-php5-intlsuse-upgrade-php5-jsonsuse-upgrade-php5-ldapsuse-upgrade-php5-mbstringsuse-upgrade-php5-mcryptsuse-upgrade-php5-mysqlsuse-upgrade-php5-odbcsuse-upgrade-php5-opcachesuse-upgrade-php5-opensslsuse-upgrade-php5-pcntlsuse-upgrade-php5-pdosuse-upgrade-php5-pearsuse-upgrade-php5-pgsqlsuse-upgrade-php5-pharsuse-upgrade-php5-posixsuse-upgrade-php5-pspellsuse-upgrade-php5-shmopsuse-upgrade-php5-snmpsuse-upgrade-php5-soapsuse-upgrade-php5-socketssuse-upgrade-php5-sqlitesuse-upgrade-php5-suhosinsuse-upgrade-php5-sysvmsgsuse-upgrade-php5-sysvsemsuse-upgrade-php5-sysvshmsuse-upgrade-php5-tokenizersuse-upgrade-php5-wddxsuse-upgrade-php5-xmlreadersuse-upgrade-php5-xmlrpcsuse-upgrade-php5-xmlwritersuse-upgrade-php5-xslsuse-upgrade-php5-zipsuse-upgrade-php5-zlibsuse-upgrade-php53suse-upgrade-php53-bcmathsuse-upgrade-php53-bz2suse-upgrade-php53-calendarsuse-upgrade-php53-ctypesuse-upgrade-php53-curlsuse-upgrade-php53-dbasuse-upgrade-php53-develsuse-upgrade-php53-domsuse-upgrade-php53-exifsuse-upgrade-php53-fastcgisuse-upgrade-php53-fileinfosuse-upgrade-php53-ftpsuse-upgrade-php53-gdsuse-upgrade-php53-gettextsuse-upgrade-php53-gmpsuse-upgrade-php53-iconvsuse-upgrade-php53-imapsuse-upgrade-php53-intlsuse-upgrade-php53-jsonsuse-upgrade-php53-ldapsuse-upgrade-php53-mbstringsuse-upgrade-php53-mcryptsuse-upgrade-php53-mysqlsuse-upgrade-php53-odbcsuse-upgrade-php53-opensslsuse-upgrade-php53-pcntlsuse-upgrade-php53-pdosuse-upgrade-php53-pearsuse-upgrade-php53-pgsqlsuse-upgrade-php53-posixsuse-upgrade-php53-pspellsuse-upgrade-php53-readlinesuse-upgrade-php53-shmopsuse-upgrade-php53-snmpsuse-upgrade-php53-soapsuse-upgrade-php53-socketssuse-upgrade-php53-sqlitesuse-upgrade-php53-suhosinsuse-upgrade-php53-sysvmsgsuse-upgrade-php53-sysvsemsuse-upgrade-php53-sysvshmsuse-upgrade-php53-tidysuse-upgrade-php53-tokenizersuse-upgrade-php53-wddxsuse-upgrade-php53-xmlreadersuse-upgrade-php53-xmlrpcsuse-upgrade-php53-xmlwritersuse-upgrade-php53-xslsuse-upgrade-php53-zipsuse-upgrade-php53-zlibsuse-upgrade-php7suse-upgrade-php7-bcmathsuse-upgrade-php7-bz2suse-upgrade-php7-calendarsuse-upgrade-php7-ctypesuse-upgrade-php7-curlsuse-upgrade-php7-dbasuse-upgrade-php7-develsuse-upgrade-php7-domsuse-upgrade-php7-enchantsuse-upgrade-php7-exifsuse-upgrade-php7-fastcgisuse-upgrade-php7-fileinfosuse-upgrade-php7-fpmsuse-upgrade-php7-ftpsuse-upgrade-php7-gdsuse-upgrade-php7-gettextsuse-upgrade-php7-gmpsuse-upgrade-php7-iconvsuse-upgrade-php7-imapsuse-upgrade-php7-intlsuse-upgrade-php7-jsonsuse-upgrade-php7-ldapsuse-upgrade-php7-mbstringsuse-upgrade-php7-mcryptsuse-upgrade-php7-mysqlsuse-upgrade-php7-odbcsuse-upgrade-php7-opcachesuse-upgrade-php7-opensslsuse-upgrade-php7-pcntlsuse-upgrade-php7-pdosuse-upgrade-php7-pearsuse-upgrade-php7-pear-archive_tarsuse-upgrade-php7-pgsqlsuse-upgrade-php7-pharsuse-upgrade-php7-posixsuse-upgrade-php7-pspellsuse-upgrade-php7-shmopsuse-upgrade-php7-snmpsuse-upgrade-php7-soapsuse-upgrade-php7-socketssuse-upgrade-php7-sqlitesuse-upgrade-php7-sysvmsgsuse-upgrade-php7-sysvsemsuse-upgrade-php7-sysvshmsuse-upgrade-php7-tokenizersuse-upgrade-php7-wddxsuse-upgrade-php7-xmlreadersuse-upgrade-php7-xmlrpcsuse-upgrade-php7-xmlwritersuse-upgrade-php7-xslsuse-upgrade-php7-zipsuse-upgrade-php7-zlib | Jan 4, 2017 | Jan 4, 2017 |
| Ubuntu | ubuntu-upgrade-libapache2-mod-php5ubuntu-upgrade-php5-cgiubuntu-upgrade-php5-cliubuntu-upgrade-php5-fpm | Feb 15, 2017 | Jan 4, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub