CVE-2015-6835

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 36.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-05-16 · updated 2026-06-17

Description

The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.

Affected products

PHP: through 5.4.44; 5.6.0-alpha1, 5.6.0-alpha2, 5.6.0-alpha3, 5.6.0-alpha4, 5.6.0-alpha5, 5.6.0-beta1 (+56)

References

http://php.net/ChangeLog-5.php
http://www.debian.org/security/2015/dsa-3358
http://www.securityfocus.com/bid/76734
http://www.securitytracker.com/id/1033548
https://bugs.php.net/bug.php?id=70219
https://security.gentoo.org/glsa/201606-10
http://php.net/ChangeLog-5.php
http://www.debian.org/security/2015/dsa-3358
http://www.securityfocus.com/bid/76734
http://www.securitytracker.com/id/1033548
https://bugs.php.net/bug.php?id=70219
https://security.gentoo.org/glsa/201606-10

Get alerted when CVE-2015-6835 or the next vulnerability affects your stack