Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

PHP before 5.6.25 and 7.x before 7.0.10: Invalid Time Data Causes Crash

CVE-2016-7129 · published 10 years ago
Summary

A vulnerability in PHP's handling of time data could allow an attacker to crash the server or potentially cause other issues. This affects PHP versions 5.6.25 and earlier, as well as PHP 7.x up to version 7.0.10. To protect your site, update to a fixed version of PHP as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
php php 7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
<= 5.6.24
cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*
Original advisory text
The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecifi...
The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
7% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published12 Sep 2016
Updated4 Nov 2026
First seen4 Aug 2026
Sources
CVE-2016-7129 · OSV
CVE-2016-7129 · NVD
Track software like this
Free during beta