CVE-2015-2787

Severity

75%

Complexity

99%

Confidentiality

106%

CWE-416: Use After Free

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.

CWE-416: Use After Free

CVSS 2.0 Base Score 7.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P).

Overview

First reported 9 years ago

2015-03-30 10:59:00

Last updated 6 years ago

2018-10-30 16:27:00

Affected Software

PHP PHP

PHP 5.5.0

5.5.0

PHP 5.5.0 alpha1

5.5.0

PHP 5.5.0 alpha2

5.5.0

PHP 5.5.0 alpha3

5.5.0

PHP 5.5.0 alpha4

5.5.0

PHP 5.5.0 alpha5

5.5.0

PHP 5.5.0 alpha6

5.5.0

PHP 5.5.0 beta1

5.5.0

PHP 5.5.0 beta2

5.5.0

PHP 5.5.0 beta3

5.5.0

PHP 5.5.0 beta4

5.5.0

PHP 5.5.0 release candidate 1

5.5.0

PHP 5.5.0 release candidate 2

5.5.0

PHP 5.5.1

5.5.1

PHP 5.5.2

5.5.2

PHP 5.5.3

5.5.3

PHP 5.5.4

5.5.4

PHP 5.5.5

5.5.5

PHP 5.5.6

5.5.6

PHP 5.5.7

5.5.7

PHP 5.5.8

5.5.8

PHP 5.5.9

5.5.9

PHP 5.5.10

5.5.10

PHP 5.5.11

5.5.11

PHP 5.5.12

5.5.12

PHP 5.5.13

5.5.13

PHP 5.5.14

5.5.14

PHP 5.5.15

5.5.15

PHP 5.5.16

5.5.16

PHP 5.5.17

5.5.17

PHP 5.5.18

5.5.18

PHP 5.5.19

5.5.19

PHP 5.5.20

5.5.20

PHP 5.5.21

5.5.21

PHP 5.5.22

5.5.22

PHP 5.6.0 alpha1

5.6.0

PHP 5.6.0 alpha2

5.6.0

PHP 5.6.0 alpha3

5.6.0

PHP 5.6.0 alpha4

5.6.0

PHP 5.6.0 alpha5

5.6.0

PHP 5.6.0 beta1

5.6.0

PHP 5.6.0 beta2

5.6.0

PHP 5.6.0 beta3

5.6.0

PHP 5.6.0 beta4

5.6.0

PHP PHP 5.6.1

5.6.1

PHP 5.6.2

5.6.2

PHP 5.6.3

5.6.3

PHP 5.6.4

5.6.4

PHP 5.6.5

5.6.5

PHP 5.6.6

5.6.6

Apple Mac OS X

Apple Mac OS X 10.9.5

10.9.5

Apple Mac OS X 10.10.0

10.10.0

Apple Mac OS X 10.10.1

10.10.1

Apple Mac OS X Yosemite 10.10.2

10.10.2

Apple Mac OS X 10.10.3

10.10.3

Apple Mac OS X 10.10.4

10.10.4

RedHat Enterprise Linux Desktop 7.0

7.0

RedHat Enterprise Linux HPC Node 7.0

7.0

RedHat Enterprise Linux Server 7.0

7.0

RedHat Enterprise Linux Workstation 7.0

7.0

OpenSUSE 13.1

13.1

OpenSUSE 13.2

13.2

References

APPLE-SA-2015-08-13-2

Vendor Advisory

APPLE-SA-2015-09-30-3

Vendor Advisory

SUSE-SU-2015:0868

openSUSE-SU-2015:0684

HPSBMU03380

HPSBMU03409

http://php.net/ChangeLog-5.php

RHSA-2015:1053

RHSA-2015:1066

RHSA-2015:1135

RHSA-2015:1218

http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

73431

1032485

USN-2572-1

https://bugs.php.net/bug.php?id=68976

Exploit

https://gist.github.com/smalyshev/eea9eafc7c88a4a6d10d

GLSA-201606-10

https://support.apple.com/HT205267

Vendor Advisory

https://support.apple.com/kb/HT205031

Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.