CVE-2015-6834critical
Description
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.
References
http://php.net/ChangeLog-5.php
http://www.debian.org/security/2015/dsa-3358
http://www.securityfocus.com/bid/76649
http://www.securitytracker.com/id/1033548
https://bugs.php.net/bug.php?id=70172
https://bugs.php.net/bug.php?id=70365
Details
Source: MITRE
Published: 2016-05-16
Updated: 2017-11-04
Type: NVD-CWE-Other
Risk Information
CVSS v2
Base Score: 7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 10
Severity: HIGH
CVSS v3
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 3.9
Severity: CRITICAL