CVE-2015-0231
Public on 2015-01-27
Modified on 2015-04-15
Description
A use-after-free flaw was found in the way PHP's unserialize() function processed data. If a remote attacker was able to pass crafted input to PHP's unserialize() function, they could cause the PHP interpreter to crash or, possibly, execute arbitrary code.
Severity
Medium
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | php54 | 2015-02-11 | ALAS-2015-475 | Fixed |
| Amazon Linux 1 | php54 | 2015-04-15 | ALAS-2015-506 | Fixed |
| Amazon Linux 1 | php55 | 2015-02-11 | ALAS-2015-474 | Fixed |
| Amazon Linux 1 | php55 | 2015-04-15 | ALAS-2015-507 | Fixed |
| Amazon Linux 1 | php56 | 2015-04-15 | ALAS-2015-508 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv2 | 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P |
| NVD | CVSSv2 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |