#Yet Another Use After Free Vulnerability in unserialize() with SplDoublyLinkedList
Taoguang Chen <@chtg> - Write Date: 2015.8.27 - Release Date: 2015.9.4
A use-after-free vulnerability was discovered in unserialize() with SplDoublyLinkedList object's deserialization and crafted object's __wakeup() magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.
Affected is PHP 5.6 < 5.6.13
Affected is PHP 5.5 < 5.5.29
#Yet Another Use After Free Vulnerability in unserialize() with SplObjectStorage
Taoguang Chen <@chtg> - Write Date: 2015.8.27 - Release Date: 2015.9.4
A use-after-free vulnerability was discovered in unserialize() with SplObjectStorage object's deserialization and crafted object's __wakeup() magic method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.
Affected is PHP 5.6 < 5.6.13
Affected is PHP 5.5 < 5.5.29
#Use After Free Vulnerabilities in Session Deserializer
Taoguang Chen <@chtg> - Write Date: 2015.8.9 - Release Date: 2015.9.4
Multiple use-after-free vulnerabilities were discovered in session deserializer (php/php_binary/php_serialize) that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.
Affected is PHP 5.6 < 5.6.13
Affected is PHP 5.5 < 5.5.29
#Use After Free Vulnerability in unserialize() with GMP
Taoguang Chen <@chtg> - Write Date: 2015.8.17 - Release Date: 2015.9.4
A use-after-free vulnerability was discovered in unserialize() with GMP object's deserialization that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.
Affected is PHP 5.6 < 5.6.13
#Use After Free Vulnerabilities in unserialize()
Taoguang Chen <@chtg> - Write Date: 2015.7.31 - Release Date: 2015.9.4
Multiple use-after-free vulnerabilities were discovered in unserialize() with Serializable class that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.
Affected is PHP 5.6 < 5.6.13
Affected is PHP 5.5 < 5.5.29
#Use After Free Vulnerability in unserialize() with SplDoublyLinkedList
Taoguang Chen <@chtg> - Write Date: 2015.7.30 - Release Date: 2015.8.7
A use-after-free vulnerability was discovered in unserialize() with SplDoublyLinkedList object's deserialization that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.
Affected is PHP 5.6 < 5.6.12
Affected is PHP 5.5 < 5.5.28
#Use After Free Vulnerability in unserialize() with SplObjectStorage
Taoguang Chen <@chtg> - Write Date: 2015.7.30 - Release Date: 2015.8.7
A use-after-free vulnerability was discovered in unserialize() with SplObjectStorage object's deserialization that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.
Affected is PHP 5.6 < 5.6.12
Affected is PHP 5.5 < 5.5.28
#Use After Free Vulnerability in unserialize() with SPL ArrayObject
Taoguang Chen <@chtg> - Write Date: 2015.7.30 - Release Date: 2015.8.7
A use-after-free vulnerability was discovered in unserialize() with SPL ArrayObject object's deserialization that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely.
Affected is PHP 5.6 < 5.6.12
Affected is PHP 5.5 < 5.5.28
Taoguang Chen <@chtg> - Write Date: 2015.3.3 - Release Date: 2015.4.28
A type confusion vulnerability was discovered in exception object's __toString()/getTraceAsString() method that can be abused for leaking arbitrary memory blocks or heap overflow.
Affected is PHP 5.6 < 5.6.8
Affected is PHP 5.5 < 5.5.24
Taoguang Chen <@chtg> - Write Date: 2015.3.1 - Release Date: 2015.3.20
Four type confusion vulnerabilities were discovered in SoapClient object's some methods that can be abused for leaking arbitrary memory blocks.
Affected is PHP 5.6 < 5.6.7
Affected is PHP 5.5 < 5.5.23