Description
Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obtain sensitive information via serialized data, related to the PHP unserialize function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | php5 | 5.2.6.dfsg.1-1+lenny9 | DSA-2089-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php5 | 5.6.28-1.1 | openSUSE-SU-2024:10344-1 |
| openSUSE Tumbleweed | php7 | 7.0.14-1.4 | openSUSE-SU-2024:10290-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
Advisories 4
- DSA-2089-1 php5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10290-1 apache2-mod_php7-7.0.14-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10344-1 apache2-mod_php5-5.6.28-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 40860 third-party-advisory
- http://twitter.com/i0n1c/statuses/16373156076
- HPSBOV02763 vendor-advisory
- php-splobjectstorage-code-execution(59610) vdb-entry
- DSA-2089 vendor-advisory
- APPLE-SA-2010-08-24-1 vendor-advisory
- 40948 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=605641
- http://support.apple.com/kb/HT4312
- http://twitter.com/i0n1c/statuses/16447867829
- SUSE-SR:2010:017 vendor-advisory
- SUSE-SR:2010:018 vendor-advisory
- http://pastebin.com/mXGidCsd