PublicDateAtUSN: 2015-09-09
Candidate: CVE-2015-6836
PublicDate: 2016-01-19 05:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6836
 http://www.openwall.com/lists/oss-security/2015/09/07/5
 https://ubuntu.com/security/notices/USN-2758-1
Description:
 The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x
 before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers,
 which allows remote attackers to execute arbitrary code via crafted
 serialized data that triggers a "type confusion" in the
 serialize_function_call function.
Ubuntu-Description:
Notes:
Bugs:
 https://bugs.php.net/bug.php?id=70388
Priority: medium
Discovered-by: Andrea Palazzo
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L [7.3 HIGH]

Patches_php5:
 upstream: http://git.php.net/?p=php-src.git;a=commit;h=e201f01ac17243a1e5fb6a3911ed8e21b1619ac1
upstream_php5: released (5.5.29,5.6.13)
precise_php5: released (5.3.10-1ubuntu3.20)
trusty_php5: released (5.5.9+dfsg-1ubuntu4.13)
trusty/esm_php5: released (5.5.9+dfsg-1ubuntu4.13)
vivid_php5: released (5.6.4+dfsg-4ubuntu6.3)
devel_php5: released (5.6.11+dfsg-1ubuntu3)