#VU40285 Input validation error in PHP - CVE-2015-6834

Vulnerability identifier: #VU40285

Vulnerability risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2015-6834

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
PHP
Universal components / Libraries / Scripting languages

Vendor: PHP Group

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization. <a href="http://cwe.mitre.org/data/definitions/502.html">CWE-502: Deserialization of Untrusted Data</a>

Mitigation
Install update from vendor's website.

Vulnerable software versions

PHP: 5.5.0 - 5.5.28, 5.6.0 - 5.6.12

---

External links
https://php.net/ChangeLog-5.php
https://www.debian.org/security/2015/dsa-3358
https://www.securityfocus.com/bid/76649
https://www.securitytracker.com/id/1033548
https://bugs.php.net/bug.php?id=70172
https://bugs.php.net/bug.php?id=70365
https://bugs.php.net/bug.php?id=70366
https://security.gentoo.org/glsa/201606-10

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.