PublicDateAtUSN: 2015-03-30
Candidate: CVE-2015-2787
PublicDate: 2015-03-30 10:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2787
 https://gist.github.com/smalyshev/eea9eafc7c88a4a6d10d
 http://php.net/ChangeLog-5.php
 https://ubuntu.com/security/notices/USN-2572-1
Description:
 Use-after-free vulnerability in the process_nested_data function in
 ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23,
 and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code
 via a crafted unserialize call that leverages use of the unset function
 within an __wakeup function, a related issue to CVE-2015-0231.
Ubuntu-Description:
Notes:
Bugs:
 https://bugs.php.net/bug.php?id=68976
Priority: medium
Discovered-by: Taoguang Chen
Assigned-to: mdeslaur
CVSS: 

Patches_php5:
 upstream: https://github.com/php/php-src/commit/780222f97f47644a6a118ada86a269a96a1e8134 (5.6)
 upstream: https://github.com/php/php-src/commit/d76b293ac71aa5bd4e9a433192afef6e0dd5a4ee (5.6)
 upstream: https://github.com/php/php-src/commit/646572d6d3847d68124b03936719f60936b49a38 (5.4,5.5)
 upstream: https://github.com/php/php-src/commit/8b14d3052ffcffa17d6e2be652f20e18f8f562ad (5.4,5.5 test)
upstream_php5: released (5.6.7)
lucid_php5: released (5.3.2-1ubuntu4.30)
precise_php5: released (5.3.10-1ubuntu3.18)
trusty_php5: released (5.5.9+dfsg-1ubuntu4.9)
trusty/esm_php5: released (5.5.9+dfsg-1ubuntu4.9)
utopic_php5: released (5.5.12+dfsg-2ubuntu4.4)
devel_php5: released (5.6.4+dfsg-4ubuntu5)