CVE-2015-4601

PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
Affected Products (NVD)
VendorProductVersion
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_hpc_node
7.0
redhatenterprise_linux_hpc_node_eus
7.1
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_eus
7.1
redhatenterprise_linux_workstation
7.0
phpphp
𝑥
≤ 5.6.6
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
precise
Fixed 5.3.10-1ubuntu3.19
released
trusty
Fixed 5.5.9+dfsg-1ubuntu4.11
released
utopic
Fixed 5.5.12+dfsg-2ubuntu4.6
released
vivid
Fixed 5.6.4+dfsg-4ubuntu6.2
released
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
php
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-bcmath
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-cli
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-common
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-dba
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-devel
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-embedded
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-enchant
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-fpm
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-gd
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-imap
RHEL 6
0:5.3.3-46.el6_6
fixed
php-intl
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-ldap
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-mbstring
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-mysql
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-mysqlnd
RHEL 7
0:5.4.16-36.el7_1
fixed
php-odbc
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-pdo
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-pgsql
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-process
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-pspell
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-recode
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-snmp
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-soap
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-tidy
RHEL 6
0:5.3.3-46.el6_6
fixed
php-xml
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-xmlrpc
RHEL 6
0:5.3.3-46.el6_6
fixed
RHEL 7
0:5.4.16-36.el7_1
fixed
php-zts
RHEL 6
0:5.3.3-46.el6_6
fixed
References
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8
http://php.net/ChangeLog-5.php
http://rhn.redhat.com/errata/RHSA-2015-1135.html
http://rhn.redhat.com/errata/RHSA-2015-1218.html
http://www.openwall.com/lists/oss-security/2015/06/16/12
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
http://www.securityfocus.com/bid/75246
http://www.securitytracker.com/id/1032709
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0c136a2abd49298b66acb0cad504f0f972f5bfe8
http://php.net/ChangeLog-5.php
http://rhn.redhat.com/errata/RHSA-2015-1135.html
http://rhn.redhat.com/errata/RHSA-2015-1218.html
http://www.openwall.com/lists/oss-security/2015/06/16/12
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
http://www.securityfocus.com/bid/75246
http://www.securitytracker.com/id/1032709