CVE-2015-0231

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

42.59% chance of exploitation in the next 30 days, 99th percentile

Published

2015-01-27

Updated

2024-08-06

Proof-of-concept exploits (1)

• 3xp10it/php_cve-2014-8142_cve-2015-02312★ · 2017-07-13

References

• CVE Record
• NVD entry

Related

• CVE-2014-8142
• CVE-2015-0205
• CVE-2015-0235
• CVE-2015-0204
• CVE-2015-0239
• CVE-2015-0179