CVE-2015-2787: Use After Free

Q: What is the severity of CVE-2015-2787?

CVE-2015-2787 is considered a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary code.

Q: How do I fix CVE-2015-2787?

To fix CVE-2015-2787, upgrade to PHP versions 5.4.39, 5.5.23, or 5.6.7 or later.

Q: What systems are affected by CVE-2015-2787?

CVE-2015-2787 affects PHP versions before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7.

Q: What type of vulnerability is CVE-2015-2787?

CVE-2015-2787 is a use-after-free vulnerability in the process_nested_data function.

Q: Who can exploit CVE-2015-2787?

Remote attackers can exploit CVE-2015-2787 via a crafted unserialize call that leverages an unset function.

Published Mar 30, 2015

Updated

Use-after-free vulnerability in the processnesteddata function in ext/standard/varunserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an wakeup function, a related issue to CVE-2015-0231.

Affected Software

66 affected components

PHP PHP<=5.4.38

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

Apple iOS and macOS<=10.6.8

Apple iOS and macOS=10.9.5

Apple iOS and macOS=10.10.0

Apple iOS and macOS=10.10.1

Apple iOS and macOS=10.10.2

Apple iOS and macOS=10.10.3

Apple iOS and macOS=10.10.4

redhat Enterprise Linux Desktop=7.0

redhat Enterprise Linux Hpc Node=7.0

redhat Enterprise Linux Hpc Node Eus=7.1

redhat Enterprise Linux Server=7.0

redhat Enterprise Linux Server Eus=7.1

redhat Enterprise Linux Workstation=7.0

openSUSE openSUSE=13.1

openSUSE openSUSE=13.2

Event History

Mar 30, 2015

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-2787?

CVE-2015-2787 is considered a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary code.

How do I fix CVE-2015-2787?

To fix CVE-2015-2787, upgrade to PHP versions 5.4.39, 5.5.23, or 5.6.7 or later.

What systems are affected by CVE-2015-2787?