Description
Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | php +26 | 5.3.3-46.el6_6 | RHSA-2015:1218 |
Advisories 2
- RHSA-2015:1218 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- VDE-2023-009 ads-tec: Multiple Vulnerabilities in IRF1000, IRF2000 and IRF3000 CERT@VDE · May 8, 2023
References
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=fbf3a6bc1abcc8a5b5226b0ad9464c37f11ddbd6
- APPLE-SA-2015-09-30-3 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- 71800 vdb-entry
- https://support.apple.com/HT205267
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=24125f0f26f3787c006e4a51611ba33ee3b841cb
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2bcf69d073190e4f032d883f3416dea1b027a39e
- GLSA-201503-03 vendor-advisory
- [oss-security] 20141229 Re: CVE Request: Double Free in PHP mailing-list
- http://advisories.mageia.org/MGASA-2015-0040.html
- https://bugs.php.net/bug.php?id=68676
- RHSA-2015:1218 vendor-advisory