CVE-2010-2225

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-06-24 · updated 2026-06-16
Weakness: CWE-399

Description

Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obtain sensitive information via serialized data, related to the PHP unserialize function.

Affected products

PHP: 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5 (+11)

References

http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html
http://marc.info/?l=bugtraq&m=133469208622507&w=2
http://pastebin.com/mXGidCsd
http://secunia.com/advisories/40860
http://support.apple.com/kb/HT4312
http://twitter.com/i0n1c/statuses/16373156076
http://twitter.com/i0n1c/statuses/16447867829
http://www.debian.org/security/2010/dsa-2089
http://www.securityfocus.com/bid/40948
https://bugzilla.redhat.com/show_bug.cgi?id=605641

Get alerted when CVE-2010-2225 or the next vulnerability affects your stack