CVE-2015-0231: Use After Free

Q: What is the severity of CVE-2015-0231?

CVE-2015-0231 has a high severity rating, as it can lead to potential denial of service due to an out-of-bounds read.

Q: How do I fix CVE-2015-0231?

To address CVE-2015-0231, update your PHP version to 5.4.37, 5.5.21, or 5.6.5 or later.

Q: Which versions of PHP are affected by CVE-2015-0231?

CVE-2015-0231 affects PHP versions up to 5.4.36, 5.5.20, and 5.6.4.

Q: Is CVE-2015-0231 a remote attack vector?

Yes, CVE-2015-0231 can be exploited remotely, potentially allowing attackers to manipulate web applications.

Q: What are the potential consequences of exploiting CVE-2015-0231?

Exploiting CVE-2015-0231 could lead to application crashes, denial of service, or other unpredictable behavior.

Published Jan 23, 2015

Updated

It was discovered that the fix for CVE-2014-8142 (use after free vulnerability in unserialize(), see bug 1175718) was incomplete.

Upstream bug: https://bugs.php.net/bug.php?id=68710

Upstream commit: http://git.php.net/?p=php-src.git;a=commitdiff;h=b585a3aed7880a5fa5c18e2b838fc96f40e075bd

Other sources

Use-after-free vulnerability in the processnesteddata function in ext/standard/varunserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.

— MITRE

Affected Software

87 affected componentsFixes available

redhat/php<5.4.37

5.4.37

redhat/php<5.5.21

5.5.21

redhat/php<5.6.5

5.6.5

PHP PHP<=5.4.36

PHP PHP=5.4.0

PHP PHP=5.4.1

PHP PHP=5.4.2

PHP PHP=5.4.3

PHP PHP=5.4.4

PHP PHP=5.4.5

PHP PHP=5.4.6

PHP PHP=5.4.7

PHP PHP=5.4.8

PHP PHP=5.4.9

PHP PHP=5.4.10

PHP PHP=5.4.11

PHP PHP=5.4.12

PHP PHP=5.4.12-rc1

PHP PHP=5.4.12-rc2

PHP PHP=5.4.13

PHP PHP=5.4.13-rc1

PHP PHP=5.4.14

PHP PHP=5.4.14-rc1

PHP PHP=5.4.15-rc1

PHP PHP=5.4.16-rc1

PHP PHP=5.4.17

PHP PHP=5.4.18

PHP PHP=5.4.19

PHP PHP=5.4.20

PHP PHP=5.4.21

PHP PHP=5.4.22

PHP PHP=5.4.23

PHP PHP=5.4.24

PHP PHP=5.4.25

PHP PHP=5.4.26

PHP PHP=5.4.27

PHP PHP=5.4.28

PHP PHP=5.4.29

PHP PHP=5.4.30

PHP PHP=5.4.34

PHP PHP=5.4.35

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

Remediation

Patch Available

https://github.com/php/php-src/commit/b585a3aed7880a5fa5c18e2b838fc96f40e075bd

Event History

Jan 27, 2015

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-0231?