CVE-2016-9934

ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.

NULL Pointer Dereference in WDDX Packet Deserialization with PDORow in PHP before 5.6.28 (CVE-2016-9934).

Invalid read when wddx decodes empty boolean element in PHP before 5.6.29 (CVE-2016-9935).

This update for php7 fixes the following issues:

• CVE-2016-9933 Possible stack overflow on truecolor images handling [bsc#1015187]
• CVE-2016-9934 Dereference from NULL pointer could lead to crash [bsc#1015188]
• CVE-2016-9935 Invalid read could lead to crash [bsc#1015189]
• CVE-2016-9936 Use After free in the function serialize() could lead to crash [bsc#1015191]

This update for php5 fixes the following issues:

• CVE-2016-9933 Possible stack overflow on truecolor images handling [bsc#1015187]
• CVE-2016-9934 Dereference from NULL pointer could lead to crash [bsc#1015188]
• CVE-2016-9935 Invalid read could lead to crash [bsc#1015189]

This update for php53 fixes the following issues:

• CVE-2014-9912: Stack-based buffer overflow in uloc_getDisplayName() [bsc#1012232]
• CVE-2016-9933: Possible stack overflow on truecolor images handling [bsc#1015187]
• CVE-2016-9934: Dereference from NULL pointer could lead to crash [bsc#1015188]
• CVE-2016-9935: Invalid read could lead to crash [bsc#1015189]
• Buffer overflow in libmagic, allowing attackers to crash the PHP interpreter [bsc#974305]

It was discovered that PHP incorrectly handled certain arguments to the locale_get_display_name function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-9912)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to hang, resulting in a denial of service. (CVE-2016-7478)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7479)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS. (CVE-2016-9137)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-9934)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9935)

It was discovered that PHP incorrectly handled certain EXIF data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10158)

It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this issue to cause PHP to crash or consume resources, resulting in a denial of service. (CVE-2016-10159)

It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-10160)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10161)