CVE-2015-6831
Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving (1) ArrayObject, (2) SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled during unserialization.
- Score
- CVSS 3.1 7.3 High
- Status
- Modified - security@opentext.com
- Published
- 2016-01-19
- Last modified
- 2024-08-06
- Weaknesses
- CWE-416
Affected products
- Debian Linux (Debian)
- Php (Php)
References
- http://www.debian.org/security/2015/dsa-3344
- http://www.openwall.com/lists/oss-security/2015/08/19/3
- http://www.php.net/ChangeLog-5.php
- http://www.securityfocus.com/bid/76737
- https://bugs.php.net/bug.php?id=70155
- https://bugs.php.net/bug.php?id=70166
- https://bugs.php.net/bug.php?id=70168
- https://bugs.php.net/bug.php?id=70169
- https://security.gentoo.org/glsa/201606-10
