The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Apache | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Aug 28, 2015 | Jun 9, 2015 |
| Apple Osx Apachemodphp | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Mar 29, 2016 | Jun 9, 2015 |
| Centos_linux | — | Upgrade php-processUpgrade php-imapUpgrade php-soapUpgrade php-mysqlndUpgrade php-gdUpgrade php-snmpUpgrade php-pgsqlUpgrade php-intlUpgrade phpUpgrade php-commonUpgrade php-pspellUpgrade php-dbaUpgrade php-embeddedUpgrade php-odbcUpgrade php-recodeUpgrade php-tidyUpgrade php-cliUpgrade php-xmlrpcUpgrade php-mbstringUpgrade php-ztsUpgrade php-pdoUpgrade php-enchantUpgrade php-fpmUpgrade php-bcmathUpgrade php-ldapUpgrade php-xmlUpgrade php-mysqlUpgrade php-devel | Dec 1, 2016 | Jun 9, 2015 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Jun 9, 2015 |
| Oracle_linux | — | Upgrade php55-php-pgsqlUpgrade php-ldapUpgrade php-embeddedUpgrade php54-php-xmlrpcUpgrade php-dbaUpgrade php55-php-opcacheUpgrade php55Upgrade php-mysqlndUpgrade php54-php-xmlUpgrade php55-php-intlUpgrade php54-phpUpgrade php54-php-imapUpgrade php-cliUpgrade php-tidyUpgrade php-intlUpgrade php55-php-develUpgrade php55-php-imapUpgrade php55-php-mysqlndUpgrade php-processUpgrade php55-phpUpgrade php55-php-pspellUpgrade php-snmpUpgrade php-gdUpgrade phpUpgrade php55-php-gmpUpgrade php-imapUpgrade php-recodeUpgrade php54-php-processUpgrade php55-php-recodeUpgrade php-commonUpgrade php-pspellUpgrade php-pgsqlUpgrade php-soapUpgrade php54-php-pdoUpgrade php-odbcUpgrade php54-php-bcmathUpgrade php54-php-gdUpgrade php55-php-dbaUpgrade php55-php-gdUpgrade php55-php-tidyUpgrade php54-runtimeUpgrade php-fpmUpgrade php55-php-soapUpgrade php55-php-xmlrpcUpgrade php54-php-pspellUpgrade php54Upgrade php55-php-snmpUpgrade php55-php-fpmUpgrade php54-php-enchantUpgrade php-pdoUpgrade php54-php-recodeUpgrade php54-php-mysqlndUpgrade php54-php-ldapUpgrade php54-php-commonUpgrade php54-php-develUpgrade php54-php-pecl-zendopcacheUpgrade php54-php-odbcUpgrade php-xmlUpgrade php54-scldevelUpgrade php-mbstringUpgrade php55-scldevelUpgrade php55-php-odbcUpgrade php-enchantUpgrade php55-php-enchantUpgrade php55-php-cliUpgrade php54-php-dbaUpgrade php54-php-cliUpgrade php54-php-pgsqlUpgrade php54-php-snmpUpgrade php55-php-ldapUpgrade php55-php-bcmathUpgrade php-mysqlUpgrade php54-php-mbstringUpgrade php54-php-soapUpgrade php55-php-pdoUpgrade php55-php-commonUpgrade php54-php-fpmUpgrade php55-runtimeUpgrade php54-php-tidyUpgrade php55-php-processUpgrade php-develUpgrade php55-php-xmlUpgrade php-bcmathUpgrade php-xmlrpcUpgrade php55-php-mbstringUpgrade php54-php-intlUpgrade php-zts | Oct 16, 2024 | Jun 9, 2015 |
| Php | — | Upgrade to PHP version 5.6.7Upgrade to PHP version 5.4.39Upgrade to PHP version 5.5.23 | Jun 17, 2015 | Jun 9, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 3, 2015 |
| Ubuntu | — | Upgrade php5-cgiUpgrade php5-fpmUpgrade php5-cliUpgrade libapache2-mod-php5 | Nov 8, 2024 | Jun 9, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub