CVE-2015-4603

CWE-8437 documents7 sources

Severity

9.8CRITICAL

EPSS

8.1%

top 7.83%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

PHP PHP Redhat Enterprise Linux Redhat Enterprise Linux Desktop +5 more

Timeline

PublishedMay 16

Latest updateMay 14

Description

The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages6 packages

▶Ubuntuphp5< 5.5.9+dfsg-1ubuntu4.11

▶NVDphp/php5.4.39+32

▶NVDredhat/enterprise_linux_server7.0

▶NVDredhat/enterprise_linux_desktop7.0

▶NVDredhat/enterprise_linux_hpc_node7.0, 7.1+1

Also affects: Enterprise Linux 6.0, 7.0, 7.1

🔴Vulnerability Details

GHSA

GHSA-qq3c-gw9q-h6hc: The exception::getTraceAsString function in Zend/zend_exceptions↗2022-05-14

▶

CVEList

CVE-2015-4603: The exception::getTraceAsString function in Zend/zend_exceptions↗2016-05-16

▶

OSV

CVE-2015-4603: The exception::getTraceAsString function in Zend/zend_exceptions↗2015-06-17

▶

📋Vendor Advisories

Ubuntu

PHP vulnerabilities↗2015-07-06

▶

Red Hat

php: exception:: getTraceAsString type confusion issue after unserialize↗2015-03-03

▶

💬Community

Bugzilla

CVE-2015-4603 php: exception::getTraceAsString type confusion issue after unserialize↗2015-06-17

▶