CVE-2015-6835: Use After Free

Q: What is the severity of CVE-2015-6835?

CVE-2015-6835 has a high severity as it allows remote attackers to execute arbitrary code or cause denial of service through crafted session content.

Q: How do I fix CVE-2015-6835?

To fix CVE-2015-6835, upgrade your PHP installation to version 5.4.45, 5.5.29, or 5.6.13 or later.

Q: What software versions are affected by CVE-2015-6835?

CVE-2015-6835 affects PHP versions prior to 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13.

Q: What type of attacks can result from CVE-2015-6835?

CVE-2015-6835 can lead to remote code execution and denial of service attacks due to session deserialization vulnerabilities.

Q: Is CVE-2015-6835 exploitable remotely?

Yes, CVE-2015-6835 is exploitable remotely, allowing attackers to execute code on vulnerable PHP servers.

Published May 16, 2016

Updated

The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple phpvarunserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.

Affected Software

63 affected components

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP<=5.4.44

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.5.25

PHP PHP=5.5.26

PHP PHP=5.5.27

PHP PHP=5.5.28

Event History

May 16, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6835?

CVE-2015-6835 has a high severity as it allows remote attackers to execute arbitrary code or cause denial of service through crafted session content.

How do I fix CVE-2015-6835?

To fix CVE-2015-6835, upgrade your PHP installation to version 5.4.45, 5.5.29, or 5.6.13 or later.

What software versions are affected by CVE-2015-6835?