CVE-2015-6834

CRITICAL

PHP 5.4/5.5/5.6 - SplDoublyLinkedList 'Unserialize()' Use-After-Free

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2015-6834 has a selected CVSS score of 9.8 (critical); EIP currently links 2 catalogued exploits.

Description

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
2

Proofs of concept

2

Catalogued exploits

ExploitDBPHP 5.4/5.5/5.6 - SplDoublyLinkedList 'Unserialize()' Use-After-FreeExploitDB exploitby Taoguang ChenNot analyzed1 file
ExploitDB
PoC details
ExploitDBPHP 5.4/5.5/5.6 - SplObjectStorage 'Unserialize()' Use-After-FreeExploitDB exploitby Taoguang ChenNot analyzed1 file
ExploitDB
PoC details

References

9