PT-2015-3098

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.45 PHP versions 5.5.x prior to 5.5.29 PHP versions 5.6.x prior to 5.6.13 Description The issue is related to the SoapClient call method in PHP, which does not properly manage headers. This allows remote attackers to...

CVE-2015-6836

The SoapClient call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers, which allows remote attackers to execute arbitrary code via crafted serialized data that triggers a "type confusion" in the serializefunctioncall...

FreeBSD : php5 -- multiple vulnerabilities (787ef75e-44da-11e5-93ad-002590263bf5)

The PHP project reports : Core : - Fixed bug 69793 Remotely triggerable stack exhaustion via recursive method calls. - Fixed bug 70121 unserialize could lead to unexpected methods execution / NULL pointer deref. OpenSSL : - Fixed bug 70014 opensslrandompseudobytes is not cryptographically secure...

php: SoapClient's do_soap_call() type confusion after unserialize()

A flaws was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize function could cause a PHP application to crash or, possibly, execute arbitrary code...

CVE-2015-4600

The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the 1...

openSUSE Security Update : php5 (openSUSE-2015-419)

PHP was updated to fix one security issue. The following vulnerability was fixed : - CVE-2015-4148: A type confusion flay in SoapClient could lead to information disclosure bnc933227 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

SUSE SLES11 Security Update : php53 (SUSE-SU-2015:1018-1)

PHP 5.3 was updated to fix multiple security issues : bnc931776: pcntlexec does not check path validity CVE-2015-4026 bnc931772: overflow in ftpgenlist resulting in heap overflow CVE-2015-4022 bnc931769: memory corruption in pharparsetarfile when entry filename starts with NULL CVE-2015-4021...

CVE-2015-4147

The SoapClient::call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that defaultheaders is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a...

Type confusion

The SoapClient::call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that defaultheaders is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a...

CVE-2015-4147

The SoapClient::call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that defaultheaders is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a...

CVE-2015-4147

CVE-2015-4147 affects PHP’s SOAP extension. The vulnerability is in SoapClient::__call in ext/soap/soap.c where __default_headers is not verified to be an array, enabling a type confusion that allows remote code execution via crafted serialized data. Affected versions: PHP before 5.4.39, 5.5.x be...

CVE-2015-4147

The SoapClient::call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that defaultheaders is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a...

CVE-2015-4147: Undefined Security Weakness

The SoapClient::call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that defaultheaders is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a...

Fedora 21 : php-5.6.7-1.fc21 (2015-4236)

19 Mar 2015, PHP 5.6.7 Core : - Fixed bug 69174 leaks when unused inner class use traits precedence. Laruence - Fixed bug 69139 Crash in gczvalpossibleroot on unserialize. Laruence - Fixed bug 69121 Segfault in getcurrentuser when script owner is not in passwd with ZTS build. dan at syneto dot ne...

[SECURITY] [DSA 3198-2] php5 regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3198-2 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso March 28, 2015 http://www.debian.org/security/faq -...

PHP SoapClient Type Obfuscation Information Disclosure Vulnerability

PHP SoapClient is a SOAP client application. A type confusion vulnerability exists in certain methods of the PHP SoapClient object, which allows an attacker to exploit the vulnerability to obtain arbitrary memory sensitive information...

PHP 5.5.x < 5.5.23 Multiple Vulnerabilities

According to its banner, the version of PHP 5.5.x installed on the remote host is prior to 5.5.23. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists related to function 'unserialize', which can allow a remote attacker to execute arbitrary code. Note that thi...

Internet Bug Bounty: Type Confusion Vulnerability in SoapClient

Type Confusion Vulnerability in SoapClient Taoguang Chen - Write Date: 2015.3.1 - Release Date: 2015.3.20 A type confusion vulnerability was discovered in SoapClient object's getCookies method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely. Affected...

Internet Bug Bounty: SoapClient's __call() type confusion through unserialize()

https://bugs.php.net/bug.php?id=69085 Description: ------------ SoapClient's call method is prone to a type confusion vulnerability which can be used to gain remote code execution through unsafe unserialize calls. In soap.c:2906 if zendhashfindZOBJPROPPthisptr, "defaultheaders",...

Mandriva Linux Security Advisory : php (MDVSA-2013:016)

Multiple vulnerabilities has been discovered and corrected in php : PHP does not validate the configration directive soap.wsdlcachedir before writing SOAP wsdl cache files to the filesystem. Thus an attacker is able to write remote wsdl files to arbitrary locations CVE-2013-1635. PHP allows the u...