Skip to content
OpenAdvisories
Unscored USN-2758-1 10 CVEs

php5 vulnerabilities

Published Sep 30, 2015 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the PHP phar extension incorrectly handled certain
files. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service. (CVE-2015-5589)

It was discovered that the PHP phar extension incorrectly handled certain
filepaths. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2015-5590)

Taoguang Chen discovered that PHP incorrectly handled unserializing
objects. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2015-6831, CVE-2015-6834, CVE-2015-6835

Sean Heelan discovered that PHP incorrectly handled unserializing
objects. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2015-6832)

It was discovered that the PHP phar extension incorrectly handled certain
archives. A remote attacker could use this issue to cause files to be
placed outside of the destination directory. (CVE-2015-6833)

Andrea Palazzo discovered that the PHP Soap client incorrectly validated
data types. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2015-6836)

It was discovered that the PHP XSLTProcessor class incorrectly handled
certain data. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service. (CVE-2015-6837)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS php5 5.5.9+dfsg-1ubuntu4.13

Vulnerabilities 10

  • Unscored —
    CVE-2015-5589

    The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x befor…

    php5 Ubuntu
  • Unscored —
    CVE-2015-5590

    Stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5…

    php5 Ubuntu
  • Unscored —
    CVE-2015-6831

    Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow…

    php5 Ubuntu
  • Unscored —
    CVE-2015-6832

    Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x b…

    php5 Ubuntu
  • Unscored —
    CVE-2015-6833

    Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6…

    php5 Ubuntu
  • Unscored —
    CVE-2015-6834 Public exploit EPSS 47%

    Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote…

    php5 Ubuntu
  • Unscored —
    CVE-2015-6835 Public exploit EPSS 36%

    The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var…

    php5 Ubuntu
  • Unscored —
    CVE-2015-6836 EPSS 10%

    The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does…

    php5 Ubuntu
  • Unscored —
    CVE-2015-6837

    The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x befor…

    php5 Ubuntu
  • Unscored —
    CVE-2015-6838

    The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x befor…

    php5 Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-5589
  • report
    https://ubuntu.com/security/CVE-2015-5590
  • report
    https://ubuntu.com/security/CVE-2015-6831
  • report
    https://ubuntu.com/security/CVE-2015-6832
  • report
    https://ubuntu.com/security/CVE-2015-6833
  • report
    https://ubuntu.com/security/CVE-2015-6834
  • report
    https://ubuntu.com/security/CVE-2015-6835
  • report
    https://ubuntu.com/security/CVE-2015-6836
  • report
    https://ubuntu.com/security/CVE-2015-6837
  • report
    https://ubuntu.com/security/CVE-2015-6838