PT-2015-3237 · Php+2 · Php+2
Taoguangchen
·
Published
2015-09-09
·
Updated
2017-11-04
·
CVE-2015-6834
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.4.45
PHP versions 5.5.x prior to 5.5.29
PHP versions 5.6.x prior to 5.6.13
Description
The issue is related to multiple use-after-free vulnerabilities in PHP, which can be exploited by a remote attacker to execute arbitrary code. This is achieved through vectors related to the
Serializable interface, the SplObjectStorage class, and the SplDoublyLinkedList class, which are mishandled during unserialization.Recommendations
For PHP versions prior to 5.4.45, update to version 5.4.45 or later.
For PHP versions 5.5.x prior to 5.5.29, update to version 5.5.29 or later.
For PHP versions 5.6.x prior to 5.6.13, update to version 5.6.13 or later.
As a temporary workaround, consider restricting the use of the
Serializable interface, the SplObjectStorage class, and the SplDoublyLinkedList class to minimize the risk of exploitation.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Php
Suse
Ubuntu