Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before
5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary
code via vectors related to (1) the Serializable interface, (2) the
SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are
mishandled during unserialization.

mdeslaur