CVE-2015-4601: php
Vulnerability summary
CVE-2015-4601 is a high (CVSS 10.0) vulnerability in php. EPSS estimates a 8.17% chance of exploitation in the next 30 days, higher than 94.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 9 · Related 4Timeline
- 16-05-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
8.17%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.17% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Redhat6 products
- enterprise_linux_desktop7.0
- enterprise_linux_hpc_node7.0
- enterprise_linux_hpc_node_eus7.1
- enterprise_linux_server7.0
- enterprise_linux_server_eus7.1
Php1 product
- php≤ 5.6.6
Ubuntu1 product
- php5< 5.5.9+dfsg-1ubuntu4.11
3 vendors · 8 products
References
13 links- www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRM
- php.net/ChangeLog-5.phpX Refsource CONFIRM