php: dangling pointer in the unserialization of ArrayObject items
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | n/a | affected |
|
Configuration 1 [-]
|
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | |||
| rh-php56-php-0:5.6.5-8.el6 | cpe:/a:redhat:rhel_software_collections:2::el6 | RHSA-2016:0457 | 2016-03-15T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS | |||
| rh-php56-php-0:5.6.5-8.el6 | cpe:/a:redhat:rhel_software_collections:2::el6 | RHSA-2016:0457 | 2016-03-15T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | |||
| rh-php56-php-0:5.6.5-8.el6 | cpe:/a:redhat:rhel_software_collections:2::el6 | RHSA-2016:0457 | 2016-03-15T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | |||
| rh-php56-php-0:5.6.5-8.el7 | cpe:/a:redhat:rhel_software_collections:2::el7 | RHSA-2016:0457 | 2016-03-15T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS | |||
| rh-php56-php-0:5.6.5-8.el7 | cpe:/a:redhat:rhel_software_collections:2::el7 | RHSA-2016:0457 | 2016-03-15T00:00:00Z |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS | |||
| rh-php56-php-0:5.6.5-8.el7 | cpe:/a:redhat:rhel_software_collections:2::el7 | RHSA-2016:0457 | 2016-03-15T00:00:00Z |
No data available yet.
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-341-1 | php5 security update |
EUVD |
EUVD-2015-6768 | Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to execute arbitrary code via crafted serialized data that triggers misuse of an array field. |
Ubuntu USN |
USN-2758-1 | PHP vulnerabilities |
No CVSS v4.0
No CVSS v3.1
This CVE is not in the KEV list.
Exploit prediction score: 5.0% (5.014% probability within 30 days)
Key SSVC decision points have not yet been added.
No history.