CVE-2015-8876 : Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exce

Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.

Published 2016-05-22 01:59:08

Updated 2019-02-14 18:48:14

Source MITRE

View at NVD, CVE.org

Vulnerability category: Memory CorruptionDenial of service

Threat overview for CVE-2015-8876

Top countries where our scanners detected CVE-2015-8876

Top open port discovered on systems with this issue 80

IPs affected by CVE-2015-8876 350,587

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2015-8876!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2015-8876

EPSS FAQ

3.51%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 90 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-8876

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2015-8876

https://bugs.php.net/bug.php?id=70121

PHP :: Sec Bug #70121 :: unserialize() could lead to unexpected methods execution / NULL pointer deref
Exploit;Vendor Advisory
http://www.php.net/ChangeLog-5.php

PHP: PHP 5 ChangeLog
Vendor Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2750.html

RHSA-2016:2750 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url

Products affected by CVE-2015-8876

PHP » PHP
Versions from including (>=) 5.5.0 and before (<) 5.5.28
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 5.4.0 and before (<) 5.4.44
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 5.6.0 and before (<) 5.6.12
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2015-8876

Threat overview for CVE-2015-8876

Exploit prediction scoring system (EPSS) score for CVE-2015-8876

CVSS scores for CVE-2015-8876

References for CVE-2015-8876

Products affected by CVE-2015-8876