CVE-2015-6834
CriticalSummary
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code. These issues are related to the Serializable interface, the SplObjectStorage class, and the SplDoublyLinkedList class, which are mishandled during unserialization.
Risk Assessment
An attacker can exploit these vulnerabilities to execute arbitrary code remotely, potentially leading to system compromise or data leakage.
Recommendation
It is recommended to update PHP to the latest version to eliminate these vulnerabilities and ensure application security.
Original NVD description (English source)
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.