CVE-2015-8876: Null Pointer Dereference
Zend/zendexceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8876?
CVE-2015-8876 is considered a denial of service vulnerability that can lead to application crashes due to NULL pointer dereference.
How do I fix CVE-2015-8876?
To fix CVE-2015-8876, upgrade PHP to version 5.4.44, 5.5.28, or 5.6.12 or later.
What versions of PHP are affected by CVE-2015-8876?
CVE-2015-8876 affects PHP versions prior to 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12.
What type of attacks can exploit CVE-2015-8876?
CVE-2015-8876 can be exploited by remote attackers to cause denial of service or unintended method execution via crafted serialized objects.
Is CVE-2015-8876 easy to exploit?
Yes, the vulnerability can be exploited relatively easily by sending specially crafted inputs to the affected PHP applications.