CVE-2015-6835
CriticalSummary
The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, allowing remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code remotely, posing a serious threat to the security of the system and user data.
Recommendation
It is recommended to update PHP to the latest version to eliminate this vulnerability and ensure application security.
Original NVD description (English source)
The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.