CVE-2015-6831

7.3 highEPSS 7.1%

Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving (1) ArrayObject, (2) SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled during unserialization.

Severity

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 7.1% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-416
Published: 2016-01-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
php:php

References

http://www.debian.org/security/2015/dsa-3344
http://www.openwall.com/lists/oss-security/2015/08/19/3
http://www.php.net/ChangeLog-5.php
http://www.securityfocus.com/bid/76737
https://bugs.php.net/bug.php?id=70155

Check your stack JSON