CVE-2015-6831

Publication date 27 August 2015

Last updated 24 July 2024


Ubuntu priority

Cvss 3 Severity Score

7.3 · High

Score breakdown

Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving (1) ArrayObject, (2) SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled during unserialization.

Status

Package Ubuntu Release Status
php5 15.04 vivid
Fixed 5.6.4+dfsg-4ubuntu6.3
14.04 LTS trusty
Fixed 5.5.9+dfsg-1ubuntu4.13
12.04 LTS precise
Fixed 5.3.10-1ubuntu3.20

Severity score breakdown

Parameter Value
Base score 7.3 · High
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact Low
Availability impact Low
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

    • USN-2758-1
    • PHP vulnerabilities
    • 30 September 2015

Other references