CVE-2015-4599
CRITICAL
9.8
CVSS 3.0
Description
The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
Affected products and versions
- PHP — Up to and including 5.4.39
- PHP versions 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.14, 5.5.15, 5.5.16, 5.5.17, 5.5.18, 5.5.19, 5.5.20, 5.5.21, 5.5.22, 5.5.23, 5.6.0, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7
References
- git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=51856a76f87ecb24fe1385342be43610fb6c86e4
- php.net http://php.net/ChangeLog-5.php
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1135.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1218.html
- www.openwall.com http://www.openwall.com/lists/oss-security/2015/06/16/12
- www.oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- www.securityfocus.com http://www.securityfocus.com/bid/75251
- www.securitytracker.com http://www.securitytracker.com/id/1032709
- bugs.php.net https://bugs.php.net/bug.php?id=69152 Exploit
- nvd.nist.gov Official NVD record