« Volver al listado

CVE-2016-3141

Estado: ModificadaCrítica (9.8)—💥 PoC

Vulnerabilidad de uso después de liberación de memoria en wddx.c en la extensión WDDX en PHP en versiones anteriores a 5.5.33 y 5.6.x en versiones anteriores a 5.6.19 permite a atacantes remotos causar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente tener otro impacto no especificado desencadenando una llamada wddx_deserialize sobre datos XML que contienen un elemento var manipulado.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.

Tecnologías afectadas (2)

Apple — MAC OS XPHP — PHP

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-3141",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@opentext.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-03-31T16:59:00.117",
  "references": [
    {
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=b1bd4119bcafab6f9a8f84d92cd65eec3afeface",
      "source": "security@opentext.com"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00004.html",
      "source": "security@opentext.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html",
      "source": "security@opentext.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00056.html",
      "source": "security@opentext.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html",
      "source": "security@opentext.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00058.html",
      "source": "security@opentext.com"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
      "source": "security@opentext.com"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html",
      "source": "security@opentext.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/84271",
      "source": "security@opentext.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1035255",
      "source": "security@opentext.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2952-1",
      "source": "security@opentext.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2952-2",
      "source": "security@opentext.com"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=71587",
      "source": "security@opentext.com"
    },
    {
      "url": "https://php.net/ChangeLog-5.php",
      "source": "security@opentext.com"
    },
    {
      "url": "https://support.apple.com/HT206567",
      "source": "security@opentext.com"
    },
    {
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=b1bd4119bcafab6f9a8f84d92cd65eec3afeface",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2016/May/msg00004.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00056.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00058.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/84271",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1035255",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2952-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2952-2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=71587",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://php.net/ChangeLog-5.php",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.apple.com/HT206567",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de uso después de liberación de memoria en wddx.c en la extensión WDDX en PHP en versiones anteriores a 5.5.33 y 5.6.x en versiones anteriores a 5.6.19 permite a atacantes remotos causar una denegación de servicio (corrupción de memoria y caída de aplicación) o posiblemente tener otro impacto no especificado desencadenando una llamada wddx_deserialize sobre datos XML que contienen un elemento var manipulado."
    }
  ],
  "lastModified": "2026-06-17T00:45:10.487",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40347FFA-6649-4B77-A252-728945507D43",
              "versionEndIncluding": "10.11.4"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA2CD05C-85C1-41EA-87B3-5DF382481EDB",
              "versionEndIncluding": "5.5.32"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE65D0D4-CB56-4946-AB44-2EF554602A96"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1F13E2D-A8F7-4B74-8D03-7905C81672C9"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE18933A-5FE6-41C7-B1B6-DA3E762C3FB6"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AE1289F-03A6-4621-B387-5F5ADAC4AE92"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "383697F5-D29E-475A-84F3-46B54A928889"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "786ED182-5D71-4197-9196-12AB5CF05F85"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF90980D-74AD-44AA-A7C5-A0B294CCE4F8"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48D6B69C-8F27-4F4C-B953-67A7F9C2FBA5"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B53DC0C3-EA19-4465-B65A-BC7CDB10D8BF"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEA4DFC1-6C0C-42FB-9F47-E3E1AA9E47E0"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D904E21A-4B3B-4D96-850C-0C0315F14E6D"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7CEF6D7-8966-45E7-BEBB-12055F5898C6"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "171C1035-414C-4F3A-90F4-1A8ED26E3346"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "725BBA4E-B3BA-4AFA-A284-E0CDE3EC8FB4"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7793408-66A2-4DE7-B5AA-E49E8A2EE043"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95840EC0-512D-468D-99B0-17E8CFDD6BE0"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1078D15-8073-4C04-82C2-3C8111E18B6C"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B2E5E0C-8DD7-4CF8-A7E7-28ED0FD8B0C1"
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.6.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E6EE9E4-9D6E-4CCC-B116-6020DA6884BE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@opentext.com"
}