Description

The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.

Remediation

References

CVE-2016-10162

Related Vulnerabilities

WordPress Plugin Uji Countdown Cross-Site Scripting (2.0.6)

MediaWiki Improper Access Control Vulnerability (CVE-2016-6331)

WordPress Plugin Simple Giveaways-Grow your business, email lists and traffic with contests Security Bypass (2.17.3)

WordPress Plugin YaySMTP-Simple WP SMTP Mail Cross-Site Scripting (2.2.1)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions SQL Injection (2.9.7)

Severity

High

Classification

CVE-2016-10162 CWE-476 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities