CVE-2015-6835: Use After Free

Q: What is the severity of CVE-2015-6835?

CVE-2015-6835 has a high severity as it allows remote attackers to execute arbitrary code or cause denial of service through crafted session content.

Q: How do I fix CVE-2015-6835?

To fix CVE-2015-6835, upgrade your PHP installation to version 5.4.45, 5.5.29, or 5.6.13 or later.

Q: What software versions are affected by CVE-2015-6835?

CVE-2015-6835 affects PHP versions prior to 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13.

Q: What type of attacks can result from CVE-2015-6835?

CVE-2015-6835 can lead to remote code execution and denial of service attacks due to session deserialization vulnerabilities.

Q: Is CVE-2015-6835 exploitable remotely?

Yes, CVE-2015-6835 is exploitable remotely, allowing attackers to execute code on vulnerable PHP servers.

Published Sep 7, 2015

Updated

A use-after-free vulnerability was found in session deserializer. When session deserializer (php/phpbinary) is deserializing multiple data, it will call phpvarunserialize() multiple times. We can create ZVAL and free it via the phpvarunserialize() with a crafted serialized string. Then the next call phpvarunserialize() will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute arbitrary code remotely.

Upstream report:

https://bugs.php.net/bug.php?id=70219

Upstream patch:

http://git.php.net/?p=php-src.git;a=commitdiff;h=df4bf28f9f104ca3ef78ed94b497859f15b004e5

Other sources

The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple phpvarunserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.

— MITRE

Affected Software

66 affected componentsFixes available

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP<=5.4.44

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.5.25

PHP PHP=5.5.26

PHP PHP=5.5.27

PHP PHP=5.5.28

redhat/php<5.4.45

5.4.45

redhat/php<5.5.29

5.5.29

redhat/php<5.6.13

5.6.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 5.4.45
Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 5.5.29
Upgrade
Upgrade redhat/php to a version that resolves this vulnerability.
Fixed in 5.6.13
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.4.45
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.5.29
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.6.13

Event History

Sep 7, 2015

Data Sourced

via Red Hat·12:21 PM

DescriptionSeverityAffected Software

May 16, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6835?

CVE-2015-6835 has a high severity as it allows remote attackers to execute arbitrary code or cause denial of service through crafted session content.

How do I fix CVE-2015-6835?