Description

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.

Remediation

References

CVE-2015-6834

Related Vulnerabilities

MySQL Other Vulnerability (CVE-2002-0969)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction SQL Injection (3.0.9)

Moodle Server-Side Request Forgery (SSRF) Vulnerability (CVE-2018-1042)

MySQL CVE-2023-22092 Vulnerability (CVE-2023-22092)

WordPress Plugin WPS Hide Login Security Bypass (1.5.4.2)

Severity

Critical

Classification

CVE-2015-6834 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities