CVEvulnerability

CVE-2015-4600

9.8 CRITICAL Published 2016-05-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-05-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods.

Affected configurations

• redhat enterprise linux desktop 7.0 • redhat enterprise linux hpc node 7.0 • redhat enterprise linux hpc node eus 7.1 • redhat enterprise linux server 7.0 • redhat enterprise linux server eus 7.1 • redhat enterprise linux workstation 7.0 • php php (<= 5.4.39) • php php 5.5.0 • php php 5.5.1 • php php 5.5.2 • php php 5.5.3 • php php 5.5.4 • php php 5.5.5 • php php 5.5.6 • php php 5.5.7 • php php 5.5.8 • php php 5.5.9 • php php 5.5.10 • php php 5.5.11 • php php 5.5.12 • php php 5.5.13 • php php 5.5.14 • php php 5.5.15 • php php 5.5.16 • php php 5.5.17 • php php 5.5.18 • php php 5.5.19 • php php 5.5.20 • php php 5.5.21 • php php 5.5.22 • php php 5.5.23 • php php 5.6.0 • php php 5.6.1 • php php 5.6.2 • php php 5.6.3 • php php 5.6.4 • php php 5.6.5 • php php 5.6.6 • php php 5.6.7

References