SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2015-4601

PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c,…

CRITICAL 9.8EPSS 8.17%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (8.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.

CVSS 3.0
9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
8.17% probability · 95th percentile
CISA KEV
Not listed
Affected
redhat/enterprise linux desktop · redhat/enterprise linux hpc node · redhat/enterprise linux hpc node eus · redhat/enterprise linux server · redhat/enterprise linux server eus · redhat/enterprise linux workstation · php/php
Source
secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.