Bug 1260647 (CVE-2015-6835)
| Summary: | CVE-2015-6835 php: use-after-free vulnerability in session deserializer | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | anemec, bleanhar, ccoleman, dmasirka, dmcphers, fedora, gscott, jdetiber, jialiu, jkeck, jokerman, jorton, jwright, kseifried, lmeyer, mmaslano, mmccomas, rcollet, security-response-team, webstack-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | php 5.4.45, php 5.5.29, php 5.6.13 | Doc Type: | Bug Fix |
| Doc Text: |
A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-10-09 20:58:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1260665, 1305854, 1305855, 1349597 | ||
| Bug Blocks: | 1260756, 1269194, 1306180 | ||
|
Description
Adam Mariš
2015-09-07 12:21:18 UTC
Created php tracking bugs for this issue: Affects: fedora-all [bug 1260665] CVE assignment: http://seclists.org/oss-sec/2015/q3/524 php-5.6.13-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. php-5.6.13-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. php-5.6.13-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. This issue happens when untrusted input is unserialized. Doing so it documented as being unsafe: http://php.net/manual/en/function.unserialize.php Do not pass untrusted user input to unserialize(). Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via json_decode() and json_encode()) if you need to pass serialized data to the user. As this problem is triggered by unserializing untrusted inputs, which is documented as being unsafe, there is currently no plan to backport the fix to PHP packages as shipped with Red Hat Enterprise Linux 6 and 7, and Red Hat Software Collections. Future product updates may correct this issue if they rebase PHP packages to newer upstream version. This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Via RHSA-2016:0457 https://rhn.redhat.com/errata/RHSA-2016-0457.html *** Bug 1349597 has been marked as a duplicate of this bug. *** |