CVE-2015-0231 — Improper Input Validation in Apple MAC OS X

CWE-20 — Improper Input ValidationCWE-416 — Use After Free18 documents10 sources
Severity
7.5HIGHNVD
EPSS
87.3%
top 0.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Php5Apple MAC OS XPHP+8 more
Timeline
PublishedJan 27
Latest updateJan 27

Description

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages9 packages

▶Ubuntuphp5/php5< 5.5.9+dfsg-1ubuntu4.9+1
▶NVDphp/php5.4.36+64
▶NVDapple/mac_os_x10.6.8+6
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Enterprise Linux 7.1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-5394-7mcx-63pv: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer↗2022-05-17
▶
GHSA
GHSA-h66p-6c64-g354: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer↗2022-05-14
▶
OSV
CVE-2015-2787: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer↗2015-03-30
▶
OSV
php5 vulnerabilities↗2015-02-17
▶
OSV
CVE-2015-0231: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer↗2015-01-27
▶

📋Vendor Advisories

5
CISA ICS
Festo Didactic SE MES PC↗2026-01-27
▶
Red Hat
php: use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re↗2015-03-02
▶
Ubuntu
PHP vulnerabilities↗2015-02-17
▶
Red Hat
php: use after free vulnerability in unserialize() (incomplete fix of CVE-2014-8142)↗2015-01-01
▶
Apple
CVE-2015-0231: OS X El Capitan v10.11↗
▶

🕵️Threat Intelligence

3
Talos
Research Spotlight: Exploiting Use-After-Free Vulnerabilities↗2015-03-17
▶
Talos
Research Spotlight: Exploiting Use-After-Free Vulnerabilities↗2015-03-17
▶
Tenable
[R5] Tenable Products Affected by PHP &lt; 5.5.21 / 5.4.37 Vulnerabilities↗2015-02-03
▶

💬Community

3
Bugzilla
CVE-2015-2787 php: use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re↗2015-03-31
▶
Bugzilla
CVE-2015-0231 php: use after free vulnerability in unserialize() (incomplete fix of CVE-2014-8142)↗2015-01-23
▶
Bugzilla
CVE-2014-8142 php: use after free vulnerability in unserialize()↗2014-12-18
▶
CVE-2015-0231 — Improper Input Validation in Apple | cvebase