{"id":"CVE-2015-6834","aliases":["BELL-CVE-2015-6834","DLA-341-1","DSA-3358-1","EUVD-2015-6770","GHSA-6m7q-7r8q-jg24","MGASA-2015-0365","RHSA-2016:0457","SUSE-SU-2015:1633-1","UBUNTU-CVE-2015-6834","USN-2758-1"],"status":"published","title":"Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x...","description":"Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.46801,"percentile":0.98832,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2015-09-09T00:00:00Z","modified":"2026-06-29T10:11:57Z","exploits":[{"source":"exploitdb","id":"EDB-38120","title":"PHP 5.4/5.5/5.6 - SplDoublyLinkedList 'Unserialize()' Use-After-Free","type":"dos","platform":"php","date":"2015-09-09","verified":true,"url":"https://www.exploit-db.com/exploits/38120"},{"source":"exploitdb","id":"EDB-38122","title":"PHP 5.4/5.5/5.6 - SplObjectStorage 'Unserialize()' Use-After-Free","type":"dos","platform":"php","date":"2015-09-09","verified":true,"url":"https://www.exploit-db.com/exploits/38122"}],"fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"php5","fixed_in":["5.5.9+dfsg-1ubuntu4.13"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3.1-7+squeeze28"}]}],"versions":["5.3.3-7","5.3.3-7+squeeze1","5.3.3-7+squeeze13","5.3.3-7+squeeze14","5.3.3-7+squeeze15","5.3.3-7+squeeze16","5.3.3-7+squeeze17","5.3.3-7+squeeze18","5.3.3-7+squeeze19","5.3.3-7+squeeze2","5.3.3-7+squeeze20","5.3.3-7+squeeze21","5.3.3-7+squeeze22","5.3.3-7+squeeze23","5.3.3-7+squeeze24","5.3.3-7+squeeze25","5.3.3-7+squeeze3","5.3.3-7+squeeze5","5.3.3-7+squeeze6","5.3.3-7+squeeze7","5.3.3-7+squeeze8","5.3.3-7+squeeze9","5.3.3.1-7+squeeze26","5.3.3.1-7+squeeze27"],"bundled":9},{"source":"osv","ecosystem":"Debian:7","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.45-0+deb7u1"}]}],"versions":["5.4.11-1","5.4.15-1","5.4.34-0+deb7u1","5.4.35-0+deb7u1","5.4.35-0+deb7u2","5.4.36-0+deb7u1","5.4.36-0+deb7u3","5.4.38-0+deb7u1","5.4.39-0+deb7u1","5.4.39-0+deb7u2","5.4.4-14","5.4.4-14+deb7u1","5.4.4-14+deb7u10","5.4.4-14+deb7u11","5.4.4-14+deb7u12","5.4.4-14+deb7u13","5.4.4-14+deb7u14","5.4.4-14+deb7u2","5.4.4-14+deb7u3","5.4.4-14+deb7u4","5.4.4-14+deb7u5","5.4.4-14+deb7u7","5.4.4-14+deb7u8","5.4.4-14+deb7u9","5.4.4-15","5.4.4-15.1","5.4.41-0+deb7u1","5.4.44-0+deb7u1","5.4.6-1","5.4.6-2","5.4.8-1","5.4.9-1","5.4.9-2","5.4.9-3","5.4.9-4"],"bundled":5},{"source":"osv","ecosystem":"Debian:8","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.13+dfsg-0+deb8u1"}]}],"versions":["5.6.11+dfsg-1","5.6.12+dfsg-0+deb8u1","5.6.12+dfsg-1","5.6.7+dfsg-1","5.6.9+dfsg-0+deb8u1","5.6.9+dfsg-1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.29-1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"php-apc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.15-4.19.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-imap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-tidy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-php56-php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el6"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-bcmath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-dba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-dbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-embedded","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-enchant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-gd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-gmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-intl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-mbstring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-mysqlnd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-opcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-pdo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-process","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-pspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-recode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-soap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-php56-php-xmlrpc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.5-8.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-36.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.14-36.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.13"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.13"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4","5.5.9+dfsg-1ubuntu4.1","5.5.9+dfsg-1ubuntu4.2","5.5.9+dfsg-1ubuntu4.3","5.5.9+dfsg-1ubuntu4.4","5.5.9+dfsg-1ubuntu4.5","5.5.9+dfsg-1ubuntu4.6","5.5.9+dfsg-1ubuntu4.7","5.5.9+dfsg-1ubuntu4.9","5.5.9+dfsg-1ubuntu4.11","5.5.9+dfsg-1ubuntu4.12"],"bundled":10}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"https://bugs.php.net/bug.php?id=70366","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securitytracker.com/id/1033548","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.securityfocus.com/bid/76649","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://php.net/ChangeLog-5.php","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://bugs.php.net/bug.php?id=70365","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://bugs.php.net/bug.php?id=70172","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.debian.org/security/2015/dsa-3358","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201606-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6834","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6m7q-7r8q-jg24"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2015-6834","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0365.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16703","tags":["report"]},{"url":"http://www.php.net/ChangeLog-5.php#5.5.29","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2015/09/08/8","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0457","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1245236","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1245242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1256290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1256322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1260642","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1260647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1260683","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1260711","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1271081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1271088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1283702","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0457.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5589","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5589","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5589","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5590","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5590","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5590","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6831","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6832","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6832","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6832","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6833","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6833","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6833","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6834","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6834","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6835","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6835","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6836","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6836","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6836","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6837","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6837","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6837","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-6838","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6838","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7803","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7804","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151633-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/935074","tags":["report"]},{"url":"https://bugzilla.suse.com/942291","tags":["report"]},{"url":"https://bugzilla.suse.com/942293","tags":["report"]},{"url":"https://bugzilla.suse.com/942294","tags":["report"]},{"url":"https://bugzilla.suse.com/942295","tags":["report"]},{"url":"https://bugzilla.suse.com/942296","tags":["report"]},{"url":"https://bugzilla.suse.com/944302","tags":["report"]},{"url":"https://bugzilla.suse.com/945402","tags":["report"]},{"url":"https://bugzilla.suse.com/945403","tags":["report"]},{"url":"https://bugzilla.suse.com/945412","tags":["report"]},{"url":"https://bugzilla.suse.com/945428","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6838","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-6834","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/09/07/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2758-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5589","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5590","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-6831","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-6832","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-6833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-6835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-6836","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-6837","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-6838","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-6834","description":"Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.","status":"published","published":"2016-05-16T10:00:00Z","modified":"2024-08-06T07:36:33.406Z","updated_at":"2026-11-02T14:35:42.984856Z"}],"euvd":[{"id":"EUVD-2015-6770","description":"Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.","status":"published","published":"2016-05-16T10:00:00Z","modified":"2024-08-06T07:36:33Z","updated_at":"2026-11-03T02:21:54.34629Z"}],"ghsa":[{"id":"GHSA-6m7q-7r8q-jg24","title":"Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x...","description":"Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.","status":"published","published":"2022-05-17T00:28:13Z","modified":"2023-02-03T05:01:48Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:53:02.755418Z"}],"nvd":[{"id":"CVE-2015-6834","description":"Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.","status":"published","published":"2016-05-16T10:59:18.427Z","modified":"2026-06-17T00:31:30.167Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"BELL-CVE-2015-6834","title":"CVE-2015-6834 does not affect BellSoft software","status":"withdrawn","published":"2016-05-16T10:59:00Z","modified":"2026-01-26T09:46:22.799412Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"UBUNTU-CVE-2015-6834","description":"Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.","status":"published","published":"2015-09-09T00:00:00Z","modified":"2026-04-22T10:17:08.617227Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"DLA-341-1","title":"php5 - security update","status":"published","published":"2015-11-08T00:00:00Z","modified":"2026-03-09T01:23:09.849602Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-3358-1","title":"php5 - security update","status":"published","published":"2015-09-13T00:00:00Z","modified":"2026-03-09T01:22:48.05648Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0365","title":"Updated php packages fix security vulnerabilities","description":"Updated php packages fix security vulnerabilities:\n\nThe php package has been updated to version 5.5.29, which fixes several\nsecurity issues and other bugs.  See the upstream ChangeLog for more details.\n","status":"published","published":"2015-09-13T21:58:30Z","modified":"2026-04-16T06:26:10.957211964Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2016:0457","title":"Red Hat Security Advisory: rh-php56-php security update","status":"published","published":"2024-09-13T09:47:33Z","modified":"2026-06-29T10:11:57Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2015:1633-1","title":"Security update for php5","description":"\nThis update of PHP5 brings several security fixes.\n\nSecurity fixes:\n* CVE-2015-6831: A use after free vulnerability in unserialize() has been fixed which could be used to crash php or potentially execute code. [bnc#942291] [bnc#942294] [bnc#942295]\n* CVE-2015-6832: A dangling pointer in the unserialization of ArrayObject items could be used to crash php or potentially execute code. [bnc#942293]\n* CVE-2015-6833: A directory traversal when extracting ZIP files could be used to overwrite files outside of intended area. [bnc#942296]\n* CVE-2015-6834: A Use After Free Vulnerability in unserialize() has been fixed which could be used to crash php or potentially execute code. [bnc#945403] \n* CVE-2015-6835: A Use After Free Vulnerability in session unserialize() has been fixed which could be used to crash php or potentially execute code. [bnc#945402]\n* CVE-2015-6836: A SOAP serialize_function_call() type confusion leading to remote code execution problem was fixed. [bnc#945428]\n* CVE-2015-6837 CVE-2015-6838: Two NULL pointer dereferences in the XSLTProcessor class were fixed. [bnc#945412]\n\nBugfixes:\n* Compare with SQL_NULL_DATA correctly [bnc#935074]\n* If MD5 was disabled in net-snmp we have to disable the used MD5\n  function in ext/snmp/snmp.c as well. (bsc#944302)\n\nAlso the Suhosin framework was updated to 0.9.38. [fate#319325]\n","status":"published","published":"2015-09-17T07:51:44Z","modified":"2026-02-04T03:33:12.235872Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"USN-2758-1","title":"php5 vulnerabilities","description":"It was discovered that the PHP phar extension incorrectly handled certain\nfiles. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service. (CVE-2015-5589)\n\nIt was discovered that the PHP phar extension incorrectly handled certain\nfilepaths. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-5590)\n\nTaoguang Chen discovered that PHP incorrectly handled unserializing\nobjects. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-6831, CVE-2015-6834, CVE-2015-6835\n\nSean Heelan discovered that PHP incorrectly handled unserializing\nobjects. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-6832)\n\nIt was discovered that the PHP phar extension incorrectly handled certain\narchives. A remote attacker could use this issue to cause files to be\nplaced outside of the destination directory. (CVE-2015-6833)\n\nAndrea Palazzo discovered that the PHP Soap client incorrectly validated\ndata types. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-6836)\n\nIt was discovered that the PHP XSLTProcessor class incorrectly handled\ncertain data. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service. (CVE-2015-6837)\n","status":"published","published":"2015-09-30T20:10:18Z","modified":"2026-04-22T09:17:50.218704Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}