CVE-2016-3141

CRITICAL

Apple Mac OS X < 10.11.4 - Memory Corruption

Title source: rule

Description

Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.

Exploits (1)

nomisec WORKING POC 15 stars
by peternguyen93 · poc
https://github.com/peternguyen93/CVE-2016-3141

References (15)

Scores

CVSS v3 9.8
EPSS 0.7228
EPSS Percentile 98.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-119
Status published
Products (21)
apple/mac_os_x < 10.11.4
php/php 5.6.0
php/php 5.6.1
php/php 5.6.2
php/php 5.6.3
php/php 5.6.4
php/php 5.6.5
php/php 5.6.6
php/php 5.6.7
php/php 5.6.8
... and 11 more
Published Mar 31, 2016
Tracked Since Feb 18, 2026