The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Apache | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Aug 28, 2015 | Jun 9, 2015 |
| Apple Osx Apachemodphp | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Mar 29, 2016 | Jun 9, 2015 |
| Centos_linux | — | Upgrade php-soapUpgrade php-imapUpgrade php-embeddedUpgrade php-gdUpgrade php-processUpgrade php-recodeUpgrade php-commonUpgrade php-pspellUpgrade phpUpgrade php-pgsqlUpgrade php-tidyUpgrade php-odbcUpgrade php-intlUpgrade php-mysqlndUpgrade php-snmpUpgrade php-cliUpgrade php-dbaUpgrade php-bcmathUpgrade php-ztsUpgrade php-mbstringUpgrade php-enchantUpgrade php-fpmUpgrade php-xmlUpgrade php-develUpgrade php-ldapUpgrade php-xmlrpcUpgrade php-pdoUpgrade php-mysql | Dec 1, 2016 | Jun 9, 2015 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Jun 9, 2015 |
| Oracle_linux | — | Upgrade php55-php-develUpgrade php55-php-imapUpgrade php-tidyUpgrade php-cliUpgrade php55-php-pgsqlUpgrade php55-php-intlUpgrade php55-php-mysqlndUpgrade php55-php-opcacheUpgrade php-dbaUpgrade php55-php-gmpUpgrade php-intlUpgrade php-snmpUpgrade php-pspellUpgrade php55-php-recodeUpgrade php54-php-xmlUpgrade php54-phpUpgrade php-odbcUpgrade php54-php-processUpgrade php-processUpgrade php-commonUpgrade php-imapUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-gdUpgrade php-recodeUpgrade php54-php-bcmathUpgrade php54-php-pdoUpgrade php55-php-pspellUpgrade php54-php-imapUpgrade phpUpgrade php-soapUpgrade php-pgsqlUpgrade php-ldapUpgrade php55-phpUpgrade php55Upgrade php54-php-xmlrpcUpgrade php55-php-processUpgrade php54-php-recodeUpgrade php-enchantUpgrade php55-php-bcmathUpgrade php55-php-cliUpgrade php55-php-soapUpgrade php55-php-tidyUpgrade php55-php-xmlrpcUpgrade php55-runtimeUpgrade php55-php-dbaUpgrade php54-php-soapUpgrade php55-php-commonUpgrade php54Upgrade php54-php-mbstringUpgrade php-mysqlUpgrade php-xmlUpgrade php54-php-odbcUpgrade php-fpmUpgrade php55-php-xmlUpgrade php54-php-tidyUpgrade php54-runtimeUpgrade php55-php-pdoUpgrade php55-php-snmpUpgrade php54-php-pspellUpgrade php54-php-pgsqlUpgrade php54-php-gdUpgrade php54-php-commonUpgrade php-ztsUpgrade php-develUpgrade php-mbstringUpgrade php54-php-dbaUpgrade php54-php-fpmUpgrade php54-php-mysqlndUpgrade php54-php-snmpUpgrade php54-scldevelUpgrade php54-php-pecl-zendopcacheUpgrade php-xmlrpcUpgrade php54-php-intlUpgrade php54-php-enchantUpgrade php54-php-ldapUpgrade php-pdoUpgrade php55-php-ldapUpgrade php54-php-develUpgrade php55-php-mbstringUpgrade php55-php-fpmUpgrade php55-scldevelUpgrade php-bcmathUpgrade php55-php-enchantUpgrade php55-php-gdUpgrade php54-php-cliUpgrade php55-php-odbc | Oct 16, 2024 | Jun 9, 2015 |
| Php | — | Upgrade to PHP version 5.5.23Upgrade to PHP version 5.6.7Upgrade to PHP version 5.4.39 | Jun 17, 2015 | Jun 9, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 3, 2015 |
| Ubuntu | — | Upgrade php5-cliUpgrade libapache2-mod-php5Upgrade php5-cgiUpgrade php5-fpm | Nov 8, 2024 | Jun 9, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub