CVE-2015-8876 Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL....
CriticalCVSS 9.8
EPSS 7.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | >= 5.4.0, < 5.4.44 | 5.4.44 |
| PHP | >= 5.5.0, < 5.5.28 | 5.5.28 |
| PHP | >= 5.6.0, < 5.6.12 | 5.6.12 |
References
- RHSA-2016:2750 third-party-advisory vendor-advisory
- www.php.net vendor-advisory
- bugs.php.net exploit vendor-advisory