NetSight
IP …
high7.5

CVE-2015-2787

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x befor…

Impact

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.

Affected products

VendorProductAffected versions
PhpPhp
through 5.4.38
Versions 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4
AppleMac Os X
through 10.6.8
Versions 10.9.5, 10.10.0, 10.10.1, 10.10.2, 10.10.3
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Hpc Node
Version 7.0
RedhatEnterprise Linux Hpc Node Eus
Version 7.1
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Eus
Version 7.1
RedhatEnterprise Linux Workstation
Version 7.0
OpensuseOpensuse
Versions 13.1, 13.2

References