CVE-2015-6834
Published: 9 September 2015
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.
Priority
CVSS 3 base score: 9.8
Status
Package | Release | Status |
---|---|---|
php5 Launchpad, Ubuntu, Debian |
upstream |
Released
(5.5.29,5.6.13)
|
precise |
Released
(5.3.10-1ubuntu3.20)
|
|
trusty |
Released
(5.5.9+dfsg-1ubuntu4.13)
|
|
vivid |
Released
(5.6.4+dfsg-4ubuntu6.3)
|
|
Patches: upstream: http://git.php.net/?p=php-src.git;a=commit;h=e8429400d40e3c3aa4b22ba701991d698a2f3b2f upstream: http://git.php.net/?p=php-src.git;a=commit;h=f06a069c462d37c2e009f6d1d93b8c8e7b713393 upstream: http://git.php.net/?p=php-src.git;a=commit;h=259057b2a484747a6c73ce54c4fa0f5acbd56179 |