CVE-2015-0231

Severity

75%

Complexity

99%

Confidentiality

106%

CWE-416: Use After Free

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.

CWE-416: Use After Free

CVSS 2.0 Base Score 7.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P).

Overview

Type

PHP

First reported 10 years ago

2015-01-27 20:03:00

Last updated 8 years ago

2016-12-31 02:59:00

Affected Software

PHP 5.4.0

5.4.0

PHP 5.4.1

5.4.1

PHP 5.4.2

5.4.2

PHP 5.4.3

5.4.3

PHP 5.4.4

5.4.4

PHP 5.4.5

5.4.5

PHP 5.4.6

5.4.6

PHP 5.4.7

5.4.7

PHP 5.4.8

5.4.8

PHP 5.4.9

5.4.9

PHP 5.4.10

5.4.10

PHP 5.4.11

5.4.11

PHP 5.4.12

5.4.12

PHP 5.4.12 release candidate 1

5.4.12

PHP 5.4.12 release candidate 2

5.4.12

PHP 5.4.13

5.4.13

PHP 5.4.13 release candidate 1

5.4.13

PHP 5.4.14

5.4.14

PHP 5.4.14 release candidate 1

5.4.14

PHP 5.4.15 release candidate 1

5.4.15

PHP 5.4.16 release candidate 1

5.4.16

PHP 5.4.17

5.4.17

PHP 5.4.18

5.4.18

PHP 5.4.19

5.4.19

PHP 5.4.20

5.4.20

PHP 5.4.21

5.4.21

PHP 5.4.22

5.4.22

PHP 5.4.23

5.4.23

PHP 5.4.24

5.4.24

PHP 5.4.25

5.4.25

PHP 5.4.26

5.4.26

PHP 5.4.27

5.4.27

PHP 5.4.28

5.4.28

PHP 5.4.29

5.4.29

PHP 5.4.30

5.4.30

PHP PHP 5.4.34

5.4.34

PHP 5.4.35

5.4.35

PHP PHP

PHP 5.5.0

5.5.0

PHP 5.5.0 alpha1

5.5.0

PHP 5.5.0 alpha2

5.5.0

PHP 5.5.0 alpha3

5.5.0

PHP 5.5.0 alpha4

5.5.0

PHP 5.5.0 alpha5

5.5.0

PHP 5.5.0 alpha6

5.5.0

PHP 5.5.0 beta1

5.5.0

PHP 5.5.0 beta2

5.5.0

PHP 5.5.0 beta3

5.5.0

PHP 5.5.0 beta4

5.5.0

PHP 5.5.0 release candidate 1

5.5.0

PHP 5.5.0 release candidate 2

5.5.0

PHP 5.5.1

5.5.1

PHP 5.5.2

5.5.2

PHP 5.5.3

5.5.3

PHP 5.5.4

5.5.4

PHP 5.5.5

5.5.5

PHP 5.5.6

5.5.6

PHP 5.5.7

5.5.7

PHP 5.5.8

5.5.8

PHP 5.5.9

5.5.9

PHP 5.5.10

5.5.10

PHP 5.5.11

5.5.11

PHP 5.5.12

5.5.12

PHP 5.5.13

5.5.13

PHP 5.5.14

5.5.14

PHP 5.5.15

5.5.15

PHP 5.5.16

5.5.16

PHP 5.5.17

5.5.17

PHP 5.5.18

5.5.18

PHP 5.5.19

5.5.19

PHP 5.5.20

5.5.20

PHP 5.6.0 alpha1

5.6.0

PHP 5.6.0 alpha2

5.6.0

PHP 5.6.0 alpha3

5.6.0

PHP 5.6.0 alpha4

5.6.0

PHP 5.6.0 alpha5

5.6.0

PHP 5.6.0 beta1

5.6.0

PHP 5.6.0 beta2

5.6.0

PHP 5.6.0 beta3

5.6.0

PHP 5.6.0 beta4

5.6.0

PHP PHP 5.6.1

5.6.1

PHP 5.6.2

5.6.2

PHP 5.6.3

5.6.3

PHP 5.6.4

5.6.4

References

http://advisories.mageia.org/MGASA-2015-0040.html

APPLE-SA-2015-09-30-3

SUSE-SU-2015:0365

openSUSE-SU-2015:0325

SSRT102066

HPSBMU03380

HPSBMU03409

RHSA-2015:1053

RHSA-2015:1066

RHSA-2015:1135

DSA-3195

MDVSA-2015:032

MDVSA-2015:079

http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

http://www.php.net/ChangeLog-5.php

72539

https://bugs.php.net/bug.php?id=68710

Exploit, Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1185397

https://github.com/php/php-src/commit/b585a3aed7880a5fa5c18e2b838fc96f40e075bd

Patch, Vendor Advisory

GLSA-201503-03

GLSA-201606-10

https://support.apple.com/HT205267

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.