CVE-2015-8835
CriticalSummary
The make_http_soap_request function in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which may lead to denial of service or potentially arbitrary code execution.
Risk Assessment
Remote attackers may exploit this vulnerability to cause application crashes or execute unauthorized code, posing a serious security threat to the system.
Recommendation
It is recommended to update PHP to the latest version to mitigate this vulnerability and to monitor the application for unusual behavior.
Original NVD description (English source)
The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which allows remote attackers to cause a denial of service (NULL pointer dereference, type confusion, and application crash) or possibly execute arbitrary code via crafted serialized data representing a numerically indexed _cookies array, related to the SoapClient::__call method in ext/soap/soap.c.