CVE-2015-8876

Critical

Published: 22/05/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12, certain Exception objects are not validated, allowing remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.

Risk Assessment

Attackers can exploit this vulnerability to remotely crash the application, potentially leading to service downtime and financial losses.

Recommendation

It is recommended to upgrade PHP to the latest version to mitigate this vulnerability and ensure proper validation of Exception objects.

Original NVD description (English source)

Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.