CVE-2015-6834
Critical · 9.8CVSS
9.8
EPSS
46.8%
Published
May 16, 2016
CISA due date
—
The record
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:6.0 | php5 | 0 | 5.3.3.1-7+squeeze28 |
| Debian:7 | php5 | 0 | 5.4.45-0+deb7u1 |
| Debian:8 | php5 | 0 | 5.6.13+dfsg-0+deb8u1 |
| Mageia:4 | php | 0 | 5.5.29-1.mga4 |
| Mageia:4 | php-apc | 0 | 3.1.15-4.19.mga4 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-bcmath | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-cli | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-common | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-dba | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-dbg | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-debuginfo | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-devel | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-embedded | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-enchant | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-fpm | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-gd | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-gmp | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-imap | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-intl | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-ldap | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-mbstring | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-mysqlnd | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-odbc | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-opcache | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-pdo | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-pgsql | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-process | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-pspell | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-recode | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-snmp | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-soap | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-tidy | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-xml | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el6 | rh-php56-php-xmlrpc | 0 | 0:5.6.5-8.el6 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-bcmath | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-cli | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-common | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-dba | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-dbg | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-debuginfo | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-devel | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-embedded | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-enchant | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-fpm | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-gd | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-gmp | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-intl | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-ldap | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-mbstring | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-mysqlnd | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-odbc | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-opcache | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-pdo | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-pgsql | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-process | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-pspell | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-recode | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-snmp | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-soap | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-xml | 0 | 0:5.6.5-8.el7 |
| Red Hat:rhel_software_collections:2::el7 | rh-php56-php-xmlrpc | 0 | 0:5.6.5-8.el7 |
| SUSE:Linux Enterprise Module for Web and Scripting 12 | php5 | 0 | 5.5.14-36.1 |
| SUSE:Linux Enterprise Software Development Kit 12 | php5 | 0 | 5.5.14-36.1 |
| Ubuntu:14.04:LTS | php5 | 0 | 5.5.9+dfsg-1ubuntu4.13 |
Related vulnerabilities
- CVE-2015-5589 The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x… Also affects php5
- CVE-2015-4643 Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x… Also affects php5
- CVE-2015-4602 The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before… Also affects php5
- CVE-2015-4600 The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before… Also affects php5
- CVE-2015-4599 The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before… Also affects php5
- CVE-2015-3411 PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that… Also affects php5
- CVE-2015-6836 The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before… Also affects php5
- CVE-2015-7803 The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before… Also affects php5