CVE-2015-4116

Critical

Published: 16/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2015-4116 is a use-after-free vulnerability in the spl_ptr_heap_insert function in PHP before 5.5.27 and 5.6.x before 5.6.11. It allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise or data leakage.

Recommendation

It is recommended to upgrade PHP to version 5.5.27 or 5.6.11 and later to mitigate this vulnerability.

Original NVD description (English source)

Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.