Bug 1204868 (CVE-2015-4147) - CVE-2015-4147 php: SoapClient's __call() type confusion through unserialize()
Summary: CVE-2015-4147 php: SoapClient's __call() type confusion through unserialize()
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-4147
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Engineering1204762 Engineering1204763 Engineering1204765 Engineering1204766 1204869 Engineering1209880 Engineering1209884 Engineering1209887
Blocks: Embargoed1204871 Embargoed1210213
TreeView+ depends on / blocked
 
Reported: 2015-03-23 16:26 UTC by Vasyl Kaigorodov
Modified: 2019-09-29 13:30 UTC (History)
15 users (show)

Fixed In Version: php 5.6.7, php 5.5.23, php 5.4.39
Doc Type: Bug Fix
Doc Text:
A flaws was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
Clone Of:
Environment:
Last Closed: 2015-07-09 21:45:59 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
PHP Bug Tracker 69085 0 None None None Never
Red Hat Product Errata RHSA-2015:1053 0 normal SHIPPED_LIVE Moderate: php55 security and bug fix update 2015-06-04 12:06:06 UTC
Red Hat Product Errata RHSA-2015:1066 0 normal SHIPPED_LIVE Important: php54 security and bug fix update 2015-06-05 15:42:20 UTC
Red Hat Product Errata RHSA-2015:1135 0 normal SHIPPED_LIVE Important: php security and bug fix update 2015-06-23 12:11:40 UTC
Red Hat Product Errata RHSA-2015:1218 0 normal SHIPPED_LIVE Moderate: php security update 2015-07-09 21:01:41 UTC

Description Vasyl Kaigorodov 2015-03-23 16:26:12 UTC 
SoapClient's __call() method is prone to a type confusion vulnerability which can be used to gain remote code execution through unsafe unserialize() calls.

Upstream bug:
https://bugs.php.net/bug.php?id=69085

Upstream commit:
http://git.php.net/?p=php-src.git;a=commitdiff;h=c8eaca013a3922e8383def6158ece2b63f6ec483

CVE request:
http://seclists.org/oss-sec/2015/q1/905
Comment 1 Vasyl Kaigorodov 2015-03-23 16:26:35 UTC 
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1204869]
Comment 2 Fedora Update System 2015-03-26 22:08:49 UTC 
php-5.6.7-2.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2015-03-30 07:11:49 UTC 
php-5.6.7-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2015-03-31 21:37:44 UTC 
php-5.5.23-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Tomas Hoger 2015-04-08 20:54:56 UTC 
It seems related upstream commits are:

http://git.php.net/?p=php-src.git;a=commitdiff;h=d5248f67b58ac3107fec82c5b937fc3f4c89784a
http://git.php.net/?p=php-src.git;a=commitdiff;h=0c136a2abd49298b66acb0cad504f0f972f5bfe8
http://git.php.net/?p=php-src.git;a=commitdiff;h=c8eaca013a3922e8383def6158ece2b63f6ec483

The comment 0 above only mentions the last of the three.
Comment 11 Remi Collet 2015-04-09 06:50:03 UTC 
A typo in c8eaca013a3922e8383def6158ece2b63f6ec483 is fixed in (5.5.40)
http://git.php.net/?p=php-src.git;a=commit;h=75f40ae1f3a7ca837d230f099627d121f9b3a32f
Comment 12 Remi Collet 2015-04-13 12:10:19 UTC 
Upstream test (in 5.5+) from 
http://git.php.net/?p=php-src.git;a=patch;h=997b7e56302710bb3db00b56d0629ac75d73a207
Comment 13 Remi Collet 2015-04-13 12:54:25 UTC 
Late typo found in 5.4, 5.5, 5.6 (not yet released)

http://git.php.net/?p=php-src.git;a=commit;h=ff70b40dc978f3f4c457f72a71bb43fd17ee360b
Comment 14 Tomas Hoger 2015-06-01 12:46:12 UTC 
CVE-2015-4147 was assigned to the original issue.  Additional id CVE-2015-4148 (bug 1226916) was assigned for a related info leak issue related to uri handling in do_soap_call().

http://seclists.org/oss-sec/2015/q2/599
Comment 15 errata-xmlrpc 2015-06-04 08:04:09 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS

Via RHSA-2015:1066 https://rhn.redhat.com/errata/RHSA-2015-1066.html
Comment 16 errata-xmlrpc 2015-06-04 08:07:29 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS

Via RHSA-2015:1053 https://rhn.redhat.com/errata/RHSA-2015-1053.html
Comment 17 errata-xmlrpc 2015-06-23 08:12:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:1135 https://rhn.redhat.com/errata/RHSA-2015-1135.html
Comment 18 errata-xmlrpc 2015-07-09 17:07:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:1218 https://rhn.redhat.com/errata/RHSA-2015-1218.html
Note You need to log in before you can comment on or make changes to this bug.