CVE-2015-6834

9.8 criticalEPSS 47%

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 47% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
Published: 2016-05-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

php:php

References

http://php.net/ChangeLog-5.php
http://www.debian.org/security/2015/dsa-3358
http://www.securityfocus.com/bid/76649
http://www.securitytracker.com/id/1033548
https://bugs.php.net/bug.php?id=70172

Check your stack JSON