CVE-2015-4601

Critical

Published: 16/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

PHP versions before 5.6.7 may allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to 'type confusion' issues.

Risk Assessment

Organizations may be exposed to attacks that could lead to system crashes or unauthorized access to data.

Recommendation

It is recommended to upgrade PHP to version 5.6.7 or later to mitigate this vulnerability.

Original NVD description (English source)

PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.