CVE-2016-7130

The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25
and 7.x before 7.0.10 allows remote attackers to cause a denial of service
(NULL pointer dereference and application crash) or possibly have
unspecified other impact via an invalid base64 binary value, as
demonstrated by a wddx_deserialize call that mishandles a binary element in
a wddxPacket XML document.

Bugs

• <https://bugs.php.net/bug.php?id=72750&gt;