Debian update for php5

Published: 2016-12-17 | Updated: 2018-11-21
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2016-9935
Exploitation vector Network
Public exploit N/A
Vulnerable software
php (Debian package)
Operating systems & Components / Operating system package or component

Vendor Debian

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Out-of-bounds read

EUVDB-ID: #VU12903

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-9935

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No


The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the php_wddx_push_element function in ext/wddx/wddx.c due to out-of-bounds read. A remote attacker can submit an empty boolean element in a wddxPacket XML document and cause the service to crash.


Update the affected package to version: 5.6.29+dfsg-0+deb8u1.

Vulnerable software versions

php (Debian package): 5.6.0+dfsg-1 - 5.6.28+dfsg-0+deb8u1

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.