Debian update for php5



Published: 2016-12-17 | Updated: 2018-11-21
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2016-9935
CWE-ID CWE-125
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
php (Debian package)
Operating systems & Components / Operating system package or component

Vendor Debian

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Out-of-bounds read

EUVDB-ID: #VU12903

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2016-9935

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the php_wddx_push_element function in ext/wddx/wddx.c due to out-of-bounds read. A remote attacker can submit an empty boolean element in a wddxPacket XML document and cause the service to crash.

Mitigation

Update the affected package to version: 5.6.29+dfsg-0+deb8u1.

Vulnerable software versions

php (Debian package): 5.6.0+dfsg-1 - 5.6.28+dfsg-0+deb8u1


CPE2.3 External links

http://www.debian.org/security/2018/dsa-3737

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###