CVE-2016-5772

Vulnerability

A double-free vulnerability exists in the php_wddx_process_data function in wddx.c within the WDDX extension of PHP. The bug is triggered when wddx_deserialize mishandles crafted XML data, leading to a double-free condition. PHP versions before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 are affected [1][2][3].

Exploitation

An attacker can send specially crafted XML data to a PHP application that calls wddx_deserialize on untrusted input. No authentication or special network position is required, and the attacker does not need user interaction beyond the application processing the malicious input. The vulnerability is remotely exploitable over HTTP or any transport that delivers the crafted XML to the PHP WDDX deserialization routine.

Impact

Successful exploitation can cause a denial of service via application crash. In many scenarios, the double-free condition may also allow arbitrary code execution, giving the attacker full control of the affected system with the privileges of the PHP process.

Mitigation

Users should upgrade to PHP versions 5.5.37, 5.6.23, 7.0.8 or later, where the double-free bug is fixed [1][2][3]. Red Hat issued updated packages via RHSA-2016-2750 for Software Collections rh-php56 [2]. Apple included the fix in macOS Sierra 10.12 for the bundled PHP [4]. For systems where an immediate upgrade is not possible, disabling the WDDX extension (if not required) may mitigate risk.