NetSight
IP …
critical9.8

CVE-2016-4539

The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial o…

Impact

The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument, leading to a parser level of zero.

Affected products

VendorProductAffected versions
PhpPhp
through 5.5.34
Versions 5.6.0, 5.6.1, 5.6.2, 5.6.3, 5.6.4
OpensuseLeap
Version 42.1
FedoraprojectFedora
Version 24

Weakness classification

CWE-119

References