CVE-2015-4599

Critical

Published: 16/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The SoapFault::__toString method in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.

Risk Assessment

Organizations may be exposed to data leaks, application crashes, and the potential for remote code execution, posing a serious security threat to systems.

Recommendation

It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor applications for unauthorized activities.

Original NVD description (English source)

The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.