Vulnerability identifier: #VU1001

Vulnerability risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2015-6835

CWE-ID: CWE-416

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
PHP
Universal components / Libraries / Scripting languages

Vendor: PHP Group

Description
The vulnerability alows a remote unauthenticated user to execute arbitrary code or cause DoS conditions on the target system.
The weakness exists due to incorrect processing of multiple php_var_unserialize calls while deserializing data with the session deserializer. By sending a specially crafted serialized string, attackers can trigger a use-after-free that can be used to execute arbitrary code or cause a service crash.
Successful exploitation of the vulnerability results in arbitrary code execution or denial of service on the vulnerable system.

Mitigation
Update to version 5.5.38, 5.6.27 or 7.0.12.

Vulnerable software versions

PHP: 5.4.1 - 5.4.44, 5.5.0 - 5.5.28, 5.6.0 - 5.6.12

---

External links
http://bugs.php.net/bug.php?id=73147

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.