CVE-2015-4603

Critical

Published: 16/05/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The exception::getTraceAsString function in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise or data leakage.

Recommendation

It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.

Original NVD description (English source)

The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a "type confusion" issue.