CVE-2015-2787

high · 7.5

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.

7.5

CVSS

12.2%

EPSS (exploit prob.)

96th

EPSS percentile

2015-03-30

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

Vendor	Product	Affected versions
php	php	<= 5.4.38
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.1
php	php	5.5.2
php	php	5.5.3
php	php	5.5.4
php	php	5.5.5
php	php	5.5.6
php	php	5.5.7
php	php	5.5.8
php	php	5.5.9
php	php	5.5.10
php	php	5.5.11
php	php	5.5.12
php	php	5.5.13
php	php	5.5.14
php	php	5.5.15
php	php	5.5.16
php	php	5.5.17
php	php	5.5.18
php	php	5.5.19
php	php	5.5.20
php	php	5.5.21
php	php	5.5.22
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-2787