CVE-2015-8617
Critical · 9.8CVSS
9.8
EPSS
22.8%
Published
Jan 19, 2016
CISA due date
—
The record
Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-73782 A format string vulnerability exists in the command line interface of AOS-CX that could… CWE-134
- CVE-2026-16821 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain… CWE-134
- CVE-2026-81574 In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input… CWE-134
- CVE-2026-63073 Issue summary: OpenSSL CMP response validation passed an unexpected response sender… CWE-134
- CVE-2026-17136 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute… CWE-134
- CVE-2026-68553 Coturn is a free open source implementation of TURN and STUN Server. CWE-134
- CVE-2026-15961 IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through… CWE-134
- CVE-2026-12004 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0… CWE-134