Your submission was sent successfully! Close

CVE-2015-6836

Published: 9 September 2015

The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers, which allows remote attackers to execute arbitrary code via crafted serialized data that triggers a "type confusion" in the serialize_function_call function.

Priority

Medium

CVSS 3 base score: 7.3

Status

Package Release Status
php5
Launchpad, Ubuntu, Debian
precise
Released (5.3.10-1ubuntu3.20)
trusty
Released (5.5.9+dfsg-1ubuntu4.13)
upstream
Released (5.5.29,5.6.13)
vivid
Released (5.6.4+dfsg-4ubuntu6.3)
Patches:
upstream: http://git.php.net/?p=php-src.git;a=commit;h=e201f01ac17243a1e5fb6a3911ed8e21b1619ac1