CVE-2015-2787
HighSummary
A use-after-free vulnerability in the process_nested_data function in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages the use of the unset function within an __wakeup function.
Risk Assessment
An attacker can remotely gain control over the system, potentially leading to data leakage or full server compromise.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor applications for suspicious unserialize calls.
Other vulnerabilities in PHP
See all- CVE-2026-13081Unknown
This CVE has been rejected. Reason: Red Hat is not the CNA for PHP. CVE was reserved in error; the appropriate CNA should assign CVE IDs for these vulnerabilities.
- CVE-2026-13047Unknown
This CVE has been rejected. Reason: Red Hat is not the CNA for PHP. CVE was reserved in error; the appropriate CNA should assign CVE IDs for these vulnerabilities.
- CVE-2017-12934High
PHP versions 7.0.x before 7.0.21 and 7.1.x before 7.1.7 are prone to a heap use after free while unserializing untrusted data. This issue is related to the zval_get_type function in Zend/zend_types.h.
- CVE-2017-11628High
In PHP versions before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function could lead to denial of service or potentially allow executing code. This issue is relevant for PHP applications that accept untrusted input for the parse_ini_string or parse_ini_file function.
- CVE-2017-11142High
In PHP versions before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a denial of service attack by injecting long form variables, leading to excessive CPU consumption.
- CVE-2016-5399High
The bzread function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.
- CVE-2017-6441High
The _zval_get_long_func_ex function in PHP 7.1.2 has a vulnerability that allows attackers to cause a denial of service through crafted use of 'declare(ticks=' in a PHP script, leading to a NULL pointer dereference and application crash.
- CVE-2017-7272High
PHP versions up to 7.1.11 enable potential SSRF attacks in applications that accept a hostname argument for fsockopen or pfsockopen, expecting the port number to be constrained. Due to the recognition of :port syntax, fsockopen will use the port number specified in the hostname argument instead of the port number in the second argument of the function.
- CVE-2016-10161High
The object_common1 function in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.
- CVE-2016-10158High
The exif_convert_any_to_int function in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.
Original NVD description (English source)
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.