CVE-2015-6834: Use After Free

Q: What is the severity of CVE-2015-6834?

CVE-2015-6834 has been rated as critical due to its potential to allow remote code execution.

Q: How do I fix CVE-2015-6834?

To resolve CVE-2015-6834, upgrade PHP to versions 5.4.45, 5.5.29, or 5.6.13 or later.

Q: What software versions are vulnerable to CVE-2015-6834?

CVE-2015-6834 affects PHP versions prior to 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13.

Q: What types of vulnerabilities are described in CVE-2015-6834?

CVE-2015-6834 describes multiple use-after-free vulnerabilities related to the Serializable interface, SplObjectStorage class, and SplDoublyLinkedList class.

Q: How can remote attackers exploit CVE-2015-6834?

Remote attackers can exploit CVE-2015-6834 to execute arbitrary code by leveraging the vulnerable PHP functionalities.

Published May 16, 2016

Updated

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.

Affected Software

43 affected components

PHP PHP<=5.4.44

PHP PHP=5.5.0

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.5.25

PHP PHP=5.5.26

PHP PHP=5.5.27

PHP PHP=5.5.28

PHP PHP=5.6.0

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

Event History

May 16, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6834?

CVE-2015-6834 has been rated as critical due to its potential to allow remote code execution.

How do I fix CVE-2015-6834?

To resolve CVE-2015-6834, upgrade PHP to versions 5.4.45, 5.5.29, or 5.6.13 or later.

What software versions are vulnerable to CVE-2015-6834?