CVE-2015-6836

The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers, which…

published January 19, 2016

CVSS

—

EPSS

10%

Percentile

95.7

In the wild

Unconfirmed

What it is

The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers, which allows remote attackers to execute arbitrary code via crafted serialized data that triggers a "type confusion" in the serialize_function_call function.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.10323 · 95.7th percentile
Published: 2016-01-19T02:00Z

EPSS history

Timeline

19 JAN 02:00Z
The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers, which…
cvelistv5