CVE-2015-4602

Critical

Published: 16/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The __PHP_Incomplete_Class function in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.

Risk Assessment

This vulnerability can lead to application crashes, affecting service availability, and may allow attackers to execute unauthorized code, posing a serious security threat to the system.

Recommendation

It is recommended to update PHP to the latest version to eliminate this vulnerability and conduct an application audit to identify and fix potential data type issues.

Original NVD description (English source)

The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.