The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Apache | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Aug 28, 2015 | Jun 9, 2015 |
| Apple Osx Apachemodphp | — | Apply OS X security update 2015-006Upgrade macOS to the latest version | Mar 29, 2016 | Jun 9, 2015 |
| Centos_linux | — | Upgrade php-enchantUpgrade php-mysqlUpgrade php-xmlUpgrade php-bcmathUpgrade php-ztsUpgrade php-pdoUpgrade php-mbstringUpgrade php-fpmUpgrade php-ldapUpgrade php-xmlrpcUpgrade php-develUpgrade php-imapUpgrade php-soapUpgrade php-cliUpgrade php-odbcUpgrade php-gdUpgrade php-mysqlndUpgrade phpUpgrade php-tidyUpgrade php-embeddedUpgrade php-pspellUpgrade php-recodeUpgrade php-intlUpgrade php-dbaUpgrade php-processUpgrade php-commonUpgrade php-snmpUpgrade php-pgsql | Dec 1, 2016 | Jun 9, 2015 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Jun 9, 2015 |
| Oracle_linux | — | Upgrade php55-php-odbcUpgrade php55-php-dbaUpgrade php54Upgrade php55-php-bcmathUpgrade php55-php-soapUpgrade php55-php-cliUpgrade php-enchantUpgrade php-develUpgrade php-mysqlUpgrade php55-php-pdoUpgrade php54-php-tidyUpgrade php55-php-enchantUpgrade php55-php-tidyUpgrade php-mbstringUpgrade php54-runtimeUpgrade php55-php-xmlUpgrade php-ztsUpgrade php54-php-mysqlndUpgrade php-fpmUpgrade php54-php-pspellUpgrade php54-php-odbcUpgrade php-xmlUpgrade php54-php-snmpUpgrade php54-php-recodeUpgrade php55-php-snmpUpgrade php55-php-xmlrpcUpgrade php-xmlrpcUpgrade php54-php-pecl-zendopcacheUpgrade php54-php-intlUpgrade php54-php-commonUpgrade php54-php-enchantUpgrade php-pdoUpgrade php54-php-develUpgrade php54-php-ldapUpgrade php-bcmathUpgrade php55-php-fpmUpgrade php54-php-pgsqlUpgrade php55-php-mbstringUpgrade php55-php-gdUpgrade php55-php-ldapUpgrade php54-scldevelUpgrade php55-php-processUpgrade php54-php-mbstringUpgrade php54-php-cliUpgrade php55-scldevelUpgrade php54-php-soapUpgrade php55-runtimeUpgrade php55-php-commonUpgrade php54-php-gdUpgrade php54-php-dbaUpgrade php54-php-fpmUpgrade php-gdUpgrade php-soapUpgrade php-recodeUpgrade php55-php-imapUpgrade php55-php-gmpUpgrade php55-php-recodeUpgrade php55-php-opcacheUpgrade php-tidyUpgrade php55Upgrade phpUpgrade php-cliUpgrade php54-php-pdoUpgrade php55-php-develUpgrade php55-php-pspellUpgrade php55-phpUpgrade php54-phpUpgrade php-odbcUpgrade php-processUpgrade php-commonUpgrade php-snmpUpgrade php-embeddedUpgrade php54-php-imapUpgrade php-ldapUpgrade php-pspellUpgrade php-mysqlndUpgrade php55-php-intlUpgrade php54-php-xmlUpgrade php-dbaUpgrade php55-php-mysqlndUpgrade php-intlUpgrade php54-php-xmlrpcUpgrade php55-php-pgsqlUpgrade php-imapUpgrade php54-php-bcmathUpgrade php-pgsqlUpgrade php54-php-process | Oct 16, 2024 | Jun 9, 2015 |
| Php | — | Upgrade to PHP version 5.4.39Upgrade to PHP version 5.5.23Upgrade to PHP version 5.6.7 | Jun 17, 2015 | Jun 9, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 3, 2015 |
| Ubuntu | — | Upgrade php5-cgiUpgrade php5-fpmUpgrade php5-cliUpgrade libapache2-mod-php5 | Nov 8, 2024 | Jun 9, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub