CVE-2016-10162

Name of the Vulnerable Software and Affected Versions PHP versions 7.0.0 through 7.0.14 PHP versions 7.1.0 through 7.1.0

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash. This occurs when an inapplicable class name is present in a wddxPacket XML document, leading to mishandling in a wddx deserialize call. The php wddx pop element function in ext/wddx/wddx.c is specifically affected.

Recommendations For PHP versions 7.0.0 through 7.0.14, update to version 7.0.15 or later. For PHP versions 7.1.0 through 7.1.0, update to version 7.1.1 or later.