Main Vulnerability Database Vulnerabilities #VU16101

Use-after-free in PHP - CVE-2015-0231

Published: November 27, 2018 / Updated: June 17, 2021

Vulnerability identifier: #VU16101

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-0231

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to гse-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5. A remote attacker can trigger memory corruption via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an objecе. Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Affected software

PHP

Amazon Linux AMI
Gentoo Linux
Slackware Linux
Fedora
php5 (Ubuntu package)
php

How to mitigate CVE-2015-0231

Install update from vendor's website.

- addressed in versions 5.4.37, 5.5.21, 5.6.5
php5 (Ubuntu package) - addressed in versions 5.3.10-1ubuntu3.16, 5.5.9+dfsg-1ubuntu4.6, 5.5.12+dfsg-2ubuntu4.2
php - addressed in versions 5.6.5-1.fc21, 5.6.7-1.fc21, 5.6.7-2.fc22

Links to Public Exploits and PoC-codes

Exploit #6438 - Kerio Control Unified Threat Management 9.1.0 build 1087 / 9.1.1 build 1324 - Multiple Vulnerabilities (June 17, 2021)

External References

https://bugs.php.net/bug.php?id=68710