SUSE: CVE-2015-8835: SUSE Linux Security Advisory
Description
The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which allows remote attackers to cause a denial of service (NULL pointer dereference, type confusion, and application crash) or possibly execute arbitrary code via crafted serialized data representing a numerically indexed _cookies array, related to the SoapClient::__call method in ext/soap/soap.c.
Solution(s)
- suse-upgrade-apache2-mod_php5
- suse-upgrade-apache2-mod_php53
- suse-upgrade-php5
- suse-upgrade-php5-bcmath
- suse-upgrade-php5-bz2
- suse-upgrade-php5-calendar
- suse-upgrade-php5-ctype
- suse-upgrade-php5-curl
- suse-upgrade-php5-dba
- suse-upgrade-php5-devel
- suse-upgrade-php5-dom
- suse-upgrade-php5-enchant
- suse-upgrade-php5-exif
- suse-upgrade-php5-fastcgi
- suse-upgrade-php5-fileinfo
- suse-upgrade-php5-fpm
- suse-upgrade-php5-ftp
- suse-upgrade-php5-gd
- suse-upgrade-php5-gettext
- suse-upgrade-php5-gmp
- suse-upgrade-php5-iconv
- suse-upgrade-php5-intl
- suse-upgrade-php5-json
- suse-upgrade-php5-ldap
- suse-upgrade-php5-mbstring
- suse-upgrade-php5-mcrypt
- suse-upgrade-php5-mysql
- suse-upgrade-php5-odbc
- suse-upgrade-php5-opcache
- suse-upgrade-php5-openssl
- suse-upgrade-php5-pcntl
- suse-upgrade-php5-pdo
- suse-upgrade-php5-pear
- suse-upgrade-php5-pgsql
- suse-upgrade-php5-posix
- suse-upgrade-php5-pspell
- suse-upgrade-php5-shmop
- suse-upgrade-php5-snmp
- suse-upgrade-php5-soap
- suse-upgrade-php5-sockets
- suse-upgrade-php5-sqlite
- suse-upgrade-php5-suhosin
- suse-upgrade-php5-sysvmsg
- suse-upgrade-php5-sysvsem
- suse-upgrade-php5-sysvshm
- suse-upgrade-php5-tokenizer
- suse-upgrade-php5-wddx
- suse-upgrade-php5-xmlreader
- suse-upgrade-php5-xmlrpc
- suse-upgrade-php5-xmlwriter
- suse-upgrade-php5-xsl
- suse-upgrade-php5-zip
- suse-upgrade-php5-zlib
- suse-upgrade-php53
- suse-upgrade-php53-bcmath
- suse-upgrade-php53-bz2
- suse-upgrade-php53-calendar
- suse-upgrade-php53-ctype
- suse-upgrade-php53-curl
- suse-upgrade-php53-dba
- suse-upgrade-php53-devel
- suse-upgrade-php53-dom
- suse-upgrade-php53-exif
- suse-upgrade-php53-fastcgi
- suse-upgrade-php53-fileinfo
- suse-upgrade-php53-ftp
- suse-upgrade-php53-gd
- suse-upgrade-php53-gettext
- suse-upgrade-php53-gmp
- suse-upgrade-php53-iconv
- suse-upgrade-php53-imap
- suse-upgrade-php53-intl
- suse-upgrade-php53-json
- suse-upgrade-php53-ldap
- suse-upgrade-php53-mbstring
- suse-upgrade-php53-mcrypt
- suse-upgrade-php53-mysql
- suse-upgrade-php53-odbc
- suse-upgrade-php53-openssl
- suse-upgrade-php53-pcntl
- suse-upgrade-php53-pdo
- suse-upgrade-php53-pear
- suse-upgrade-php53-pgsql
- suse-upgrade-php53-posix
- suse-upgrade-php53-pspell
- suse-upgrade-php53-readline
- suse-upgrade-php53-shmop
- suse-upgrade-php53-snmp
- suse-upgrade-php53-soap
- suse-upgrade-php53-sockets
- suse-upgrade-php53-sqlite
- suse-upgrade-php53-suhosin
- suse-upgrade-php53-sysvmsg
- suse-upgrade-php53-sysvsem
- suse-upgrade-php53-sysvshm
- suse-upgrade-php53-tidy
- suse-upgrade-php53-tokenizer
- suse-upgrade-php53-wddx
- suse-upgrade-php53-xmlreader
- suse-upgrade-php53-xmlrpc
- suse-upgrade-php53-xmlwriter
- suse-upgrade-php53-xsl
- suse-upgrade-php53-zip
- suse-upgrade-php53-zlib
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center