PHP 'DateInterval' Object Use After Free Remote Code Execution Vulnerability

Bugtraq ID:	73381
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 20 2015 12:00AM
Updated:	Jul 15 2015 12:29AM
Credit:	Taoguang Chen
Vulnerable:	PHP PHP 5.4.3 PHP PHP 5.4.2 PHP PHP 5.4.1 PHP PHP 5.3.13 PHP PHP 5.3.12 PHP PHP 5.3.9 PHP PHP 5.3.8 PHP PHP 5.3.7 PHP PHP 5.3.6 PHP PHP 5.3.5 PHP PHP 5.3.2 PHP PHP 5.3.1 PHP PHP 5.3 PHP PHP 5.3.4 PHP PHP 5.3.3 PHP PHP 5.3.11 PHP PHP 5.3.10 HP HP-UX B.11.31
Not Vulnerable:

PHP 'DateInterval' Object Use After Free Remote Code Execution Vulnerability

PHP is prone to a remote code-execution vulnerability.

Successfully exploiting this issue may allow remote attackers to leak arbitrary memory or execute arbitrary code in the context of a web server. Failed attempts will likely result in denial-of-service conditions.

PHP 'DateInterval' Object Use After Free Remote Code Execution Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/73381.php.txt

PHP 'DateInterval' Object Use After Free Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

PHP 'DateInterval' Object Use After Free Remote Code Execution Vulnerability

References:

• PHP Homepage (PHP)