CVE-2015-6834

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 46.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-05-16 · updated 2026-06-17

Description

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.

Affected products

PHP: through 5.4.44; 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5 (+36)

References

http://php.net/ChangeLog-5.php
http://www.debian.org/security/2015/dsa-3358
http://www.securityfocus.com/bid/76649
http://www.securitytracker.com/id/1033548
https://bugs.php.net/bug.php?id=70172
https://bugs.php.net/bug.php?id=70365
https://bugs.php.net/bug.php?id=70366
https://security.gentoo.org/glsa/201606-10
http://php.net/ChangeLog-5.php
http://www.debian.org/security/2015/dsa-3358
http://www.securityfocus.com/bid/76649
http://www.securitytracker.com/id/1033548

Get alerted when CVE-2015-6834 or the next vulnerability affects your stack