CVE-2015-4148
MEDIUM
5.0
CVSS 2.0
Description
The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
Affected products and versions
- PHP — Up to and including 5.4.38
- PHP versions 5.5.0, 5.5.0alpha1, 5.5.0alpha2, 5.5.0alpha3, 5.5.0alpha4, 5.5.0alpha5, 5.5.0alpha6, 5.5.0beta1, 5.5.0beta2, 5.5.0beta3, 5.5.0beta4, 5.5.0rc1, 5.5.0rc2, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.14, 5.5.18, 5.5.19, 5.5.20, 5.5.21, 5.5.22, 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6
References
- lists.apple.com http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2015-06/msg00028.html
- openwall.com http://openwall.com/lists/oss-security/2015/06/01/4 Exploit
- php.net http://php.net/ChangeLog-5.php Patch
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1053.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1066.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1135.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1218.html
- www.oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- www.securityfocus.com http://www.securityfocus.com/bid/75103
- www.securitytracker.com http://www.securitytracker.com/id/1032459
- bugs.php.net https://bugs.php.net/bug.php?id=69085 Exploit, Patch
- security.gentoo.org https://security.gentoo.org/glsa/201606-10
- support.apple.com https://support.apple.com/kb/HT205031
- nvd.nist.gov Official NVD record