Description
The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | php5 | 5.3.3.1-7+squeeze27 | DLA-307-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | php5 | 5.5.9+dfsg-1ubuntu4.11 | USN-2658-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | php +24 | 5.4.16-36.ael7b_1 | RHSA-2015:1135 |
| RHEL 6 | php +26 | 5.3.3-46.el6_6 | RHSA-2015:1218 |
| RHEL 2 | php54 +5 | 2.0-1.el6 | RHSA-2015:1066, RHSA-2015:1053 |
| RHEL 2 | php54-php +24 | 5.4.40-1.el6 | RHSA-2015:1066 |
| RHEL 2 | php54-php-pecl-zendopcache | 7.0.4-3.el6 | RHSA-2015:1066 |
| RHEL 2 | php55-php +26 | 5.5.21-2.el6 | RHSA-2015:1053 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | php5 | 5.5.14-30.1 | SUSE-SU-2015:1253-2, SUSE-SU-2015:1253-1 |
| SLES 11 SP2 | php53 | 5.3.17-47.1 | SUSE-SU-2016:1638-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | php +24 | 5.4.16-36.el7_1 | ELSA-2015-1135 |
| Oracle Linux 7 | php54 +5 | 2.0-1.el7 | ELSA-2015-1066, ELSA-2015-1053 |
| Oracle Linux 7 | php54-php +22 | 5.4.40-1.el7 | ELSA-2015-1066 |
| Oracle Linux 7 | php54-php-imap +1 | 5.4.40-1.el6 | ELSA-2015-1066 |
| Oracle Linux 7 | php54-php-pecl-zendopcache | 7.0.4-3.el7 | ELSA-2015-1066 |
| Oracle Linux 7 | php55-php +26 | 5.5.21-2.0.1.el6 | ELSA-2015-1053 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- SMF (Simple Machine Forum) 2.0.10 - Remote Memory Exfiltration EDB-38304 · webapps · Sep 24, 2015
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 12
- RHSA-2015:1218 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1135 Red Hat Security Advisory: php security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1066 Red Hat Security Advisory: php54 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1053 Red Hat Security Advisory: php55 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-2658-1 php5 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-307-1 php5 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2016:1638-1 Security update for php53 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1253-1 Security update for php5 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1253-2 Security update for php5 SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2015-1066 Important: php54 security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 4, 2016
- ELSA-2015-1053 Moderate: php55 security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 4, 2016
- ELSA-2015-1135 Important: php security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 23, 2015
References
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- 1032459 vdb-entry
- [oss-security] 20150601 Re: CVE Request: PHP SoapClient's __call() type confusion through unserialize() mailing-list
- http://php.net/ChangeLog-5.php
- APPLE-SA-2015-08-13-2 vendor-advisory
- https://bugs.php.net/bug.php?id=69085
- RHSA-2015:1135 vendor-advisory
- https://support.apple.com/kb/HT205031
- RHSA-2015:1053 vendor-advisory
- openSUSE-SU-2015:1057 vendor-advisory
- GLSA-201606-10 vendor-advisory
- 75103 vdb-entry
- RHSA-2015:1066 vendor-advisory
- RHSA-2015:1218 vendor-advisory