The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Apache | — | Apply OS X security update 2015-006Upgrade macOS to the latest version | Aug 28, 2015 | Jun 9, 2015 |
| Apple Osx Apachemodphp | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Mar 29, 2016 | Jun 9, 2015 |
| Centos_linux | — | Upgrade php-pdoUpgrade php-xmlUpgrade php-mbstringUpgrade php-fpmUpgrade php-bcmathUpgrade php-mysqlUpgrade php-ztsUpgrade php-enchantUpgrade php-ldapUpgrade php-xmlrpcUpgrade php-develUpgrade php-mysqlndUpgrade php-odbcUpgrade php-gdUpgrade php-pspellUpgrade php-imapUpgrade php-recodeUpgrade php-soapUpgrade php-commonUpgrade php-intlUpgrade php-dbaUpgrade php-tidyUpgrade php-cliUpgrade php-embeddedUpgrade php-pgsqlUpgrade phpUpgrade php-processUpgrade php-snmp | Dec 1, 2016 | Jun 9, 2015 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Jun 9, 2015 |
| Oracle_linux | — | Upgrade php-cliUpgrade php-mysqlndUpgrade php-commonUpgrade php54-php-processUpgrade php-imapUpgrade php54-php-bcmathUpgrade php-processUpgrade php55-php-pspellUpgrade php55-php-pgsqlUpgrade php-pgsqlUpgrade php-soapUpgrade php55-php-gmpUpgrade php-odbcUpgrade phpUpgrade php-ldapUpgrade php54-php-xmlUpgrade php-embeddedUpgrade php55-phpUpgrade php-gdUpgrade php-snmpUpgrade php55Upgrade php55-php-recodeUpgrade php-intlUpgrade php54-php-pdoUpgrade php55-php-mysqlndUpgrade php-pspellUpgrade php54-php-xmlrpcUpgrade php54-php-imapUpgrade php55-php-develUpgrade php54-phpUpgrade php55-php-intlUpgrade php55-php-imapUpgrade php-dbaUpgrade php55-php-opcacheUpgrade php-recodeUpgrade php-tidyUpgrade php54-php-develUpgrade php55-php-tidyUpgrade php54-php-ldapUpgrade php54-php-commonUpgrade php-ztsUpgrade php54-php-mysqlndUpgrade php55-runtimeUpgrade php55-php-commonUpgrade php54-php-fpmUpgrade php55-php-xmlrpcUpgrade php54-php-dbaUpgrade php-xmlUpgrade php-fpmUpgrade php-develUpgrade php54Upgrade php55-php-pdoUpgrade php55-php-xmlUpgrade php55-php-snmpUpgrade php54-php-odbcUpgrade php54-php-pspellUpgrade php55-php-bcmathUpgrade php-mysqlUpgrade php55-php-fpmUpgrade php54-php-intlUpgrade php-pdoUpgrade php-xmlrpcUpgrade php55-php-mbstringUpgrade php54-scldevelUpgrade php55-php-ldapUpgrade php54-php-snmpUpgrade php54-php-enchantUpgrade php54-php-pecl-zendopcacheUpgrade php55-scldevelUpgrade php55-php-odbcUpgrade php55-php-cliUpgrade php55-php-enchantUpgrade php-enchantUpgrade php54-php-mbstringUpgrade php54-php-pgsqlUpgrade php55-php-gdUpgrade php54-php-tidyUpgrade php-bcmathUpgrade php55-php-dbaUpgrade php54-php-gdUpgrade php54-php-recodeUpgrade php54-php-soapUpgrade php55-php-soapUpgrade php-mbstringUpgrade php54-runtimeUpgrade php55-php-processUpgrade php54-php-cli | Oct 16, 2024 | Jun 9, 2015 |
| Php | — | Upgrade to PHP version 5.5.23Upgrade to PHP version 5.4.39Upgrade to PHP version 5.6.7 | Jun 17, 2015 | Jun 9, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 3, 2015 |
| Ubuntu | — | Upgrade php5-fpmUpgrade php5-cgiUpgrade libapache2-mod-php5Upgrade php5-cli | Nov 8, 2024 | Jun 9, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub