CVE-2015-4147
HIGH
7.5
CVSS 2.0
Description
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
Affected products and versions
- PHP — Up to and including 5.4.38
- PHP versions 5.5.0, 5.5.0alpha1, 5.5.0alpha2, 5.5.0alpha3, 5.5.0alpha4, 5.5.0alpha5, 5.5.0alpha6, 5.5.0beta1, 5.5.0beta2, 5.5.0beta3, 5.5.0beta4, 5.5.0rc1, 5.5.0rc2, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.14, 5.5.18, 5.5.19, 5.5.20, 5.5.21, 5.5.22, 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6
References
- lists.apple.com http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html
- openwall.com http://openwall.com/lists/oss-security/2015/06/01/4 Exploit, Patch
- php.net http://php.net/ChangeLog-5.php Patch
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1053.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1066.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1135.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1218.html
- www.oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- www.securityfocus.com http://www.securityfocus.com/bid/73357
- www.securitytracker.com http://www.securitytracker.com/id/1032459
- bugs.php.net https://bugs.php.net/bug.php?id=69085 Exploit, Patch
- security.gentoo.org https://security.gentoo.org/glsa/201606-10
- support.apple.com https://support.apple.com/kb/HT205031 Vendor Advisory
- nvd.nist.gov Official NVD record