Bug 1204868 – CVE-2015-4147 php: SoapClient's __call() type confusion through unserialize()

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1204868 - (CVE-2015-4147) CVE-2015-4147 php: SoapClient's __call() type confusion through unserialize()

Summary:	CVE-2015-4147 php: SoapClient's __call() type confusion through unserialize()

Status:	CLOSED ERRATA

Aliases:	CVE-2015-4147

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20150303,repor...
Keywords:	Security

Depends On:	1204762 1204763 1204765 1204766 1204869 1209880 1209884 1209887
Blocks:	1204871 1210213
	Show dependency tree / graph

Reported:	2015-03-23 12:26 EDT by Vasyl Kaigorodov
Modified:	2015-11-25 05:31 EST (History)
CC List:	15 users (show)

See Also:
Fixed In Version:	php 5.6.7, php 5.5.23, php 5.4.39
Doc Type:	Bug Fix
Doc Text:	A flaws was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-07-09 17:45:59 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
PHP Bug Tracker	69085	None	None	None	Never
Red Hat Product Errata	RHSA-2015:1053	normal	SHIPPED_LIVE	Moderate: php55 security and bug fix update	2015-06-04 08:06:06 EDT
Red Hat Product Errata	RHSA-2015:1066	normal	SHIPPED_LIVE	Important: php54 security and bug fix update	2015-06-05 11:42:20 EDT
Red Hat Product Errata	RHSA-2015:1135	normal	SHIPPED_LIVE	Important: php security and bug fix update	2015-06-23 08:11:40 EDT
Red Hat Product Errata	RHSA-2015:1218	normal	SHIPPED_LIVE	Moderate: php security update	2015-07-09 17:01:41 EDT

Groups: None (edit)

Description Vasyl Kaigorodov 2015-03-23 12:26:12 EDT

SoapClient's __call() method is prone to a type confusion vulnerability which can be used to gain remote code execution through unsafe unserialize() calls.

Upstream bug:
https://bugs.php.net/bug.php?id=69085

Upstream commit:
http://git.php.net/?p=php-src.git;a=commitdiff;h=c8eaca013a3922e8383def6158ece2b63f6ec483

CVE request:
http://seclists.org/oss-sec/2015/q1/905

Comment 1 Vasyl Kaigorodov 2015-03-23 12:26:35 EDT

Created php tracking bugs for this issue:

Affects: fedora-all [bug 1204869]

Comment 2 Fedora Update System 2015-03-26 18:08:49 EDT

php-5.6.7-2.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2015-03-30 03:11:49 EDT

php-5.6.7-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2015-03-31 17:37:44 EDT

php-5.5.23-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Tomas Hoger 2015-04-08 16:54:56 EDT

It seems related upstream commits are:

http://git.php.net/?p=php-src.git;a=commitdiff;h=d5248f67b58ac3107fec82c5b937fc3f4c89784a
http://git.php.net/?p=php-src.git;a=commitdiff;h=0c136a2abd49298b66acb0cad504f0f972f5bfe8
http://git.php.net/?p=php-src.git;a=commitdiff;h=c8eaca013a3922e8383def6158ece2b63f6ec483

The comment 0 above only mentions the last of the three.

Comment 11 Remi Collet 2015-04-09 02:50:03 EDT

A typo in c8eaca013a3922e8383def6158ece2b63f6ec483 is fixed in (5.5.40)
http://git.php.net/?p=php-src.git;a=commit;h=75f40ae1f3a7ca837d230f099627d121f9b3a32f

Comment 12 Remi Collet 2015-04-13 08:10:19 EDT

Upstream test (in 5.5+) from 
http://git.php.net/?p=php-src.git;a=patch;h=997b7e56302710bb3db00b56d0629ac75d73a207

Comment 13 Remi Collet 2015-04-13 08:54:25 EDT

Late typo found in 5.4, 5.5, 5.6 (not yet released)

http://git.php.net/?p=php-src.git;a=commit;h=ff70b40dc978f3f4c457f72a71bb43fd17ee360b

Comment 14 Tomas Hoger 2015-06-01 08:46:12 EDT

CVE-2015-4147 was assigned to the original issue.  Additional id CVE-2015-4148 (bug 1226916) was assigned for a related info leak issue related to uri handling in do_soap_call().

http://seclists.org/oss-sec/2015/q2/599

Comment 15 errata-xmlrpc 2015-06-04 04:04:09 EDT

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS

Via RHSA-2015:1066 https://rhn.redhat.com/errata/RHSA-2015-1066.html

Comment 16 errata-xmlrpc 2015-06-04 04:07:29 EDT

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS

Via RHSA-2015:1053 https://rhn.redhat.com/errata/RHSA-2015-1053.html

Comment 17 errata-xmlrpc 2015-06-23 04:12:37 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:1135 https://rhn.redhat.com/errata/RHSA-2015-1135.html

Comment 18 errata-xmlrpc 2015-07-09 13:07:28 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:1218 https://rhn.redhat.com/errata/RHSA-2015-1218.html

Note You need to log in before you can comment on or make changes to this bug.