CVE-2015-4116: Use After Free
First published: Mon May 16 2016(Updated: )
Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| openSUSE Leap | =42.1 | |
| PHP PHP | <=5.5.26 | |
| PHP PHP | =5.6.0 | |
| PHP PHP | =5.6.1 | |
| PHP PHP | =5.6.2 | |
| PHP PHP | =5.6.3 | |
| PHP PHP | =5.6.4 | |
| PHP PHP | =5.6.5 | |
| PHP PHP | =5.6.6 | |
| PHP PHP | =5.6.7 | |
| PHP PHP | =5.6.8 | |
| PHP PHP | =5.6.9 | |
| PHP PHP | =5.6.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.php.net/?p=php-src.git;a=commit;h=1cbd25ca15383394ffa9ee8601c5de4c0f2f90e1
- http://lists.opensuse.org/opensuse-updates/2016-06/msg00027.html
- http://php.net/ChangeLog-5.php
- https://bugs.php.net/bug.php?id=69737
- https://www.htbridge.com/advisory/HTB23262
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=1cbd25ca15383394ffa9ee8601c5de4c0f2f90e1
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/42.1
- vendor/php
- canonical/php php
- version/php php/5.5.26
- version/php php/5.6.0
- version/php php/5.6.1
- version/php php/5.6.2
- version/php php/5.6.3
- version/php php/5.6.4
- version/php php/5.6.5
- version/php php/5.6.6
- version/php php/5.6.7
- version/php php/5.6.8
- version/php php/5.6.9
- version/php php/5.6.10