CVE-2015-4116: Use After Free
Published May 16, 2016
·Updated
Use-after-free vulnerability in the splptrheapinsert function in ext/spl/splheap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.
Affected Software
13 affected components
openSUSE Leap=42.1
PHP PHP<=5.5.26
PHP PHP=5.6.0
PHP PHP=5.6.1
PHP PHP=5.6.2
PHP PHP=5.6.3
PHP PHP=5.6.4
PHP PHP=5.6.5
PHP PHP=5.6.6
PHP PHP=5.6.7
PHP PHP=5.6.8
PHP PHP=5.6.9
PHP PHP=5.6.10
Event History
May 16, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-4116?
CVE-2015-4116 is classified as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2015-4116?
To fix CVE-2015-4116, you should upgrade PHP to version 5.5.27 or later, or to 5.6.11 or later.
3
What versions of PHP are affected by CVE-2015-4116?
CVE-2015-4116 affects all PHP versions before 5.5.27 and 5.6.x before 5.6.11.
4
How does CVE-2015-4116 allow exploitation?
CVE-2015-4116 allows exploitation by triggering a failed SplMinHeap::compare operation, leading to a use-after-free condition.
5
Can CVE-2015-4116 be exploited remotely?
Yes, CVE-2015-4116 can be exploited remotely by attackers to execute arbitrary code.