CVE-2015-4601 PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1)...
CriticalCVSS 9.8
EPSS 7.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux hpc node eus | = 7.1 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server eus | = 7.1 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| PHP | <= 5.6.6 | No fix listed |
References
- git.php.net
- php.net
- RHSA-2015:1135 vendor-advisory
- RHSA-2015:1218 vendor-advisory
- [oss-security] 20150616 Re: CVE Request: various issues in PHP mailing-list
- www.oracle.com
- 75246 vdb-entry
- 1032709 vdb-entry