CVE-2015-2787
Published: 30 March 2015
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
php5 Launchpad, Ubuntu, Debian |
lucid |
Released
(5.3.2-1ubuntu4.30)
|
| precise |
Released
(5.3.10-1ubuntu3.18)
|
|
| trusty |
Released
(5.5.9+dfsg-1ubuntu4.9)
|
|
| upstream |
Released
(5.6.7)
|
|
| utopic |
Released
(5.5.12+dfsg-2ubuntu4.4)
|
|
|
Patches: upstream: https://github.com/php/php-src/commit/780222f97f47644a6a118ada86a269a96a1e8134 upstream: https://github.com/php/php-src/commit/d76b293ac71aa5bd4e9a433192afef6e0dd5a4ee upstream: https://github.com/php/php-src/commit/646572d6d3847d68124b03936719f60936b49a38 upstream: https://github.com/php/php-src/commit/8b14d3052ffcffa17d6e2be652f20e18f8f562ad |
||