CVE-2015-4148
published 2015-06-09CVE-2015-4148: The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a…
PriorityP342medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
19.96%
97.1th percentile
The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | <= 10.10.4 | — |
| apple | os_x_yosemite_v10.10.5_and_security_update_2015-006 | — | — |
| php | php | <= 5.4.38 | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv6.5MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-88qx-xxqp-phh3: The do_soap_call function in ext/soap/soap
ghsa_unreviewed·2022-05-14
CVE-2015-4148 [MEDIUM] CWE-20 GHSA-88qx-xxqp-phh3: The do_soap_call function in ext/soap/soap
The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
OSV
php5 vulnerabilities
osv·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] php5 vulnerabilities
php5 vulnerabilities
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015-4022,
CVE-2015-4643)
Shusheng Liu discovered that PHP inc
OSV
CVE-2015-4148: The do_soap_call function in ext/soap/soap
osv·2015-06-09·CVSS 5.0
CVE-2015-4148 [MEDIUM] CVE-2015-4148: The do_soap_call function in ext/soap/soap
The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015
Red Hat
php: SoapClient's do_soap_call() type confusion after unserialize()
vendor_redhat·2015-03-03·CVSS 5.0
CVE-2015-4148 [MEDIUM] CWE-843 php: SoapClient's do_soap_call() type confusion after unserialize()
php: SoapClient's do_soap_call() type confusion after unserialize()
The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
A flaws was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
Package: php (Red Hat Enterprise Linux 5) - Will not fix
Package: php53 (Red Hat Enterprise Linux 5) - Will not fix
Package: php54-php (Red Hat Software Collections) - Affected
Package: php55-
Apple
CVE-2015-4148: OS X Yosemite v10.10.5 and Security Update 2015-006
vendor_apple·CVSS 5.0
CVE-2015-4148 [MEDIUM] CVE-2015-4148: OS X Yosemite v10.10.5 and Security Update 2015-006
Apple Security Update: About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006
Product: OS X Yosemite v10.10.5 and Security Update 2015-006
CVE: CVE-2015-4148
Component: CVE-2015-4148
No detection rules found.
Bugzilla
CVE-2015-4148 php: SoapClient's do_soap_call() type confusion after unserialize()
bugzilla·2015-06-01·CVSS 5.0
CVE-2015-4148 [MEDIUM] CVE-2015-4148 php: SoapClient's do_soap_call() type confusion after unserialize()
CVE-2015-4148 php: SoapClient's do_soap_call() type confusion after unserialize()
A type confusion flaw, leading to information disclosure, was found SoapClient's do_soap_call() function. This issue was previously tracked via bug 1204868, but separate CVE ids were assigned to individual cases mentioned in the upstream bug report.
Relevant part of the upstream bug:
https://bugs.php.net/bug.php?id=69085#1425310752
Upstream commit:
http://git.php.net/?p=php-src.git;a=commitdiff;h=0c136a2abd49298b66acb0cad504f0f972f5bfe8
See bug 1204868 for links to other related upstream commits addressing other unserialization issues in SoapClient.
Discussion:
This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 7
Red Hat Software Collectio
Bugzilla
CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 php: type confusion issue in unserialize() with various SOAP methods
bugzilla·2015-05-18·CVSS 9.8
CVE-2015-4599 [CRITICAL] CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 php: type confusion issue in unserialize() with various SOAP methods
CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 php: type confusion issue in unserialize() with various SOAP methods
PHP versions 5.4.40, 5.5.24, and 5.6.8 provide a fix for type confusion vulnerability in unserialize() function used on a various SOAP methods.
Copy-paste description of the issue from the upstream bug:
"""
PHP_METHOD(SoapFault, __toString)
{
...
faultcode = zend_read_property(soap_fault_class_entry, this_ptr, "faultcode", sizeof("faultcode")-1, 1 TSRMLS_CC);
faultstring = zend_read_property(soap_fault_class_entry, this_ptr, "faultstring", sizeof("faultstring")-1, 1 TSRMLS_CC);
file = zend_read_property(soap_fault_class_entry, this_ptr, "file", sizeof("file")-1, 1 TSRMLS_CC);
line = zend_read_property(soap_fault_class_entry, this_ptr, "line", sizeof("line")-1, 1 TSRMLS_CC);
...
Bugzilla
CVE-2015-4147 php: SoapClient's __call() type confusion through unserialize()
bugzilla·2015-03-23·CVSS 7.5
CVE-2015-4147 [HIGH] CVE-2015-4147 php: SoapClient's __call() type confusion through unserialize()
CVE-2015-4147 php: SoapClient's __call() type confusion through unserialize()
SoapClient's __call() method is prone to a type confusion vulnerability which can be used to gain remote code execution through unsafe unserialize() calls.
Upstream bug:
https://bugs.php.net/bug.php?id=69085
Upstream commit:
http://git.php.net/?p=php-src.git;a=commitdiff;h=c8eaca013a3922e8383def6158ece2b63f6ec483
CVE request:
http://seclists.org/oss-sec/2015/q1/905
Discussion:
Created php tracking bugs for this issue:
Affects: fedora-all [bug 1204869]
---
php-5.6.7-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
---
php-5.6.7-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00028.htmlhttp://openwall.com/lists/oss-security/2015/06/01/4http://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1053.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1066.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/75103http://www.securitytracker.com/id/1032459https://bugs.php.net/bug.php?id=69085https://security.gentoo.org/glsa/201606-10https://support.apple.com/kb/HT205031http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00028.htmlhttp://openwall.com/lists/oss-security/2015/06/01/4http://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1053.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1066.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/75103http://www.securitytracker.com/id/1032459https://bugs.php.net/bug.php?id=69085https://security.gentoo.org/glsa/201606-10https://support.apple.com/kb/HT205031
2015-06-09
Published