UpHeron
All vulnerabilities

Servers and applications

CVE-2015-6834

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.

Severity
Critical 9.8
Published
16 May 2016
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • Version 5.6.12
  • Version 5.6.11
  • Version 5.6.10
  • Version 5.6.9
All 43 release lines
  • Every version up to 5.4.44
  • Version 5.5.0
  • Version 5.5.1
  • Version 5.5.2
  • Version 5.5.3
  • Version 5.5.4
  • Version 5.5.5
  • Version 5.5.6
  • Version 5.5.7
  • Version 5.5.8
  • Version 5.5.9
  • Version 5.5.10
  • Version 5.5.11
  • Version 5.5.12
  • Version 5.5.13
  • Version 5.5.14
  • Version 5.5.15
  • Version 5.5.16
  • Version 5.5.17
  • Version 5.5.18
  • Version 5.5.19
  • Version 5.5.20
  • Version 5.5.21
  • Version 5.5.22
  • Version 5.5.23
  • Version 5.5.24
  • Version 5.5.25
  • Version 5.5.26
  • Version 5.5.27
  • Version 5.5.28
  • Version 5.6.0
  • Version 5.6.1
  • Version 5.6.2
  • Version 5.6.3
  • Version 5.6.4
  • Version 5.6.5
  • Version 5.6.6
  • Version 5.6.7
  • Version 5.6.8
  • Version 5.6.9
  • Version 5.6.10
  • Version 5.6.11
  • Version 5.6.12

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2015-6834
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2015-6834