critical
CVE-2015-4599
php: type confusion issue in unserialize() with various SOAP methods
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.3AV:N/AC:M/Au:N/C:P/I:N/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium), Oracle (medium), Ubuntu (medium).
Description
The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 7 | php5 | 5.4.41-0+deb7u1 |
| debian 8 | php5 | 5.6.9+dfsg-0+deb8u1 |
| Oracle Linux 6 | php, php-bcmath, php-cli and 83 more | 5.3.3-46.el6_6 and 4 more |
| Oracle Linux 7 | php, php-bcmath, php-cli and 77 more | 5.4.16-36.el7_1 and 4 more |
| ubuntu 12.04 | php5 | 5.3.10-1ubuntu3.19 |
| ubuntu 14.04 | php5 | 5.5.9+dfsg-1ubuntu4.11 |
| ubuntu 14.04-ESM | php5 | 5.5.9+dfsg-1ubuntu4.11 |
| ubuntu 14.10 | php5 | 5.5.12+dfsg-2ubuntu4.6 |
| ubuntu 15.04 | php5 | 5.6.4+dfsg-4ubuntu6.2 |
Show all 173 entries from 9 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 7 | php5 | 5.4.41-0+deb7u1 |
| debian 8 | php5 | 5.6.9+dfsg-0+deb8u1 |
| Oracle Linux 6 | php | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-bcmath | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-cli | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-common | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-dba | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-devel | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-embedded | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-enchant | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-fpm | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-gd | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-imap | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-intl | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-ldap | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-mbstring | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-mysql | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-odbc | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-pdo | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-pgsql | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-process | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-pspell | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-recode | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-snmp | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-soap | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-tidy | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-xml | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-xmlrpc | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php-zts | 5.3.3-46.el6_6 |
| Oracle Linux 6 | php54 | 2.0-1.el6 |
| Oracle Linux 6 | php54-php | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-bcmath | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-cli | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-common | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-dba | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-devel | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-enchant | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-fpm | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-gd | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-imap | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-intl | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-ldap | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-mbstring | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-mysqlnd | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-odbc | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-pdo | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-pecl-zendopcache | 7.0.4-3.el6 |
| Oracle Linux 6 | php54-php-pgsql | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-process | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-pspell | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-recode | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-snmp | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-soap | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-tidy | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-xml | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-php-xmlrpc | 5.4.40-1.el6 |
| Oracle Linux 6 | php54-runtime | 2.0-1.el6 |
| Oracle Linux 6 | php54-scldevel | 2.0-1.el6 |
| Oracle Linux 6 | php55 | 2.0-1.el6 |
| Oracle Linux 6 | php55-php | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-bcmath | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-cli | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-common | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-dba | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-devel | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-enchant | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-fpm | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-gd | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-gmp | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-imap | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-intl | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-ldap | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-mbstring | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-mysqlnd | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-odbc | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-opcache | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-pdo | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-pgsql | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-process | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-pspell | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-recode | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-snmp | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-soap | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-tidy | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-xml | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-php-xmlrpc | 5.5.21-2.0.1.el6 |
| Oracle Linux 6 | php55-runtime | 2.0-1.el6 |
| Oracle Linux 6 | php55-scldevel | 2.0-1.el6 |
| Oracle Linux 7 | php | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-bcmath | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-cli | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-common | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-dba | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-devel | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-embedded | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-enchant | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-fpm | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-gd | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-intl | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-ldap | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-mbstring | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-mysql | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-mysqlnd | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-odbc | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-pdo | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-pgsql | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-process | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-pspell | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-recode | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-snmp | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-soap | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-xml | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php-xmlrpc | 5.4.16-36.el7_1 |
| Oracle Linux 7 | php54 | 2.0-1.el7 |
| Oracle Linux 7 | php54-php | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-bcmath | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-cli | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-common | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-dba | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-devel | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-enchant | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-fpm | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-gd | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-intl | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-ldap | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-mbstring | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-mysqlnd | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-odbc | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-pdo | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-pecl-zendopcache | 7.0.4-3.el7 |
| Oracle Linux 7 | php54-php-pgsql | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-process | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-pspell | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-recode | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-snmp | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-soap | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-xml | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-php-xmlrpc | 5.4.40-1.el7 |
| Oracle Linux 7 | php54-runtime | 2.0-1.el7 |
| Oracle Linux 7 | php54-scldevel | 2.0-1.el7 |
| Oracle Linux 7 | php55 | 2.0-1.el7 |
| Oracle Linux 7 | php55-php | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-bcmath | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-cli | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-common | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-dba | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-devel | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-enchant | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-fpm | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-gd | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-gmp | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-intl | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-ldap | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-mbstring | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-mysqlnd | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-odbc | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-opcache | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-pdo | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-pgsql | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-process | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-pspell | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-recode | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-snmp | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-soap | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-xml | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-php-xmlrpc | 5.5.21-2.el7 |
| Oracle Linux 7 | php55-runtime | 2.0-1.el7 |
| Oracle Linux 7 | php55-scldevel | 2.0-1.el7 |
| ubuntu 12.04 | php5 | 5.3.10-1ubuntu3.19 |
| ubuntu 14.04 | php5 | 5.5.9+dfsg-1ubuntu4.11 |
| ubuntu 14.04-ESM | php5 | 5.5.9+dfsg-1ubuntu4.11 |
| ubuntu 14.10 | php5 | 5.5.12+dfsg-2ubuntu4.6 |
| ubuntu 15.04 | php5 | 5.6.4+dfsg-4ubuntu6.2 |
References
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=51856a76f87ecb24fe1385342be43610fb6c86e4
- http://php.net/ChangeLog-5.php
- http://rhn.redhat.com/errata/RHSA-2015-1135.html
- http://rhn.redhat.com/errata/RHSA-2015-1218.html
- http://www.openwall.com/lists/oss-security/2015/06/16/12
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/75251
- http://www.securitytracker.com/id/1032709
All 15 references
- https://access.redhat.com/security/cve/CVE-2015-4599
- https://bugs.php.net/bug.php?id=69152
- https://linux.oracle.com/cve/CVE-2015-4599.html
- https://linux.oracle.com/errata/ELSA-2015-1218.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-4599
- https://ubuntu.com/security/notices/USN-2658-1
- https://www.cve.org/CVERecord?id=CVE-2015-4599