PHP CVEs

Description

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.

Affected products and versions

• PHP — Up to and including 5.4.36
• PHP versions 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.6, 5.4.7, 5.4.8, 5.4.9, 5.4.10, 5.4.11, 5.4.12, 5.4.12rc1, 5.4.12rc2, 5.4.13, 5.4.13rc1, 5.4.14, 5.4.14rc1, 5.4.15rc1, 5.4.16rc1, 5.4.17, 5.4.18, 5.4.19, 5.4.20, 5.4.21, 5.4.22, 5.4.23, 5.4.24, 5.4.25, 5.4.26, 5.4.27, 5.4.28, 5.4.29, 5.4.30, 5.4.34, 5.4.35, 5.5.0, 5.5.0alpha1, 5.5.0alpha2, 5.5.0alpha3, 5.5.0alpha4, 5.5.0alpha5, 5.5.0alpha6, 5.5.0beta1, 5.5.0beta2, 5.5.0beta3, 5.5.0beta4, 5.5.0rc1, 5.5.0rc2, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.14, 5.5.15, 5.5.16, 5.5.17, 5.5.18, 5.5.19, 5.5.20, 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4

References

• advisories.mageia.org http://advisories.mageia.org/MGASA-2015-0040.html
• lists.apple.com http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
• lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html
• lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html
• marc.info http://marc.info/?l=bugtraq&m=143403519711434&w=2
• marc.info http://marc.info/?l=bugtraq&m=143748090628601&w=2
• marc.info http://marc.info/?l=bugtraq&m=144050155601375&w=2
• rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1053.html
• rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1066.html
• rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1135.html
• www.debian.org http://www.debian.org/security/2015/dsa-3195
• www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2015:032
• www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2015:079
• www.oracle.com http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
• www.oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
• www.php.net http://www.php.net/ChangeLog-5.php
• www.securityfocus.com http://www.securityfocus.com/bid/72539
• bugs.php.net https://bugs.php.net/bug.php?id=68710 Exploit, Vendor Advisory
• bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1185397
• github.com https://github.com/php/php-src/commit/b585a3aed7880a5fa5c18e2b838fc96f40e075bd Patch, Vendor Advisory
• security.gentoo.org https://security.gentoo.org/glsa/201503-03
• security.gentoo.org https://security.gentoo.org/glsa/201606-10
• support.apple.com https://support.apple.com/HT205267
• nvd.nist.gov Official NVD record