Bug 924972 (CVE-2015-2787) - VUL-0: CVE-2015-2787: php5,php53: Use-after-free vulnerability in the process_nested_data function inext/standard/var_unserializer.re...
Summary: VUL-0: CVE-2015-2787: php5,php53: Use-after-free vulnerability in the process...
Status: RESOLVED FIXED
Alias: CVE-2015-2787
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2015-04-13
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/115324/
Whiteboard: maint:released:sle11-sp1:61840 maint:...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-30 15:02 UTC by Marcus Meissner
Modified: 2016-08-08 14:26 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
testscript from the php bug (366 bytes, application/x-php)
2015-03-31 11:34 UTC, Petr Gajdos 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2015-03-30 15:02:03 UTC 
CVE-2015-2787

Use-after-free vulnerability in the process_nested_data function in
ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and
5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a
crafted unserialize call that leverages use of the unset function within an
__wakeup function, a related issue to CVE-2015-0231.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2787
https://bugs.php.net/bug.php?id=68976
https://gist.github.com/smalyshev/eea9eafc7c88a4a6d10d
Comment 1 Marcus Meissner 2015-03-30 15:04:07 UTC 
code seems to be in 5.2 and 5.3 too.
Comment 2 Swamp Workflow Management 2015-03-30 15:08:50 UTC 
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-04-13.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/61384
Comment 3 Swamp Workflow Management 2015-03-30 22:02:24 UTC 
bugbot adjusting priority
Comment 4 Petr Gajdos 2015-03-31 11:34:09 UTC 
Created attachment 629419 [details]
testscript from the php bug

BEFORE

$ USE_ZEND_ALLOC=0 valgrind php test.php
[bunch of errors here]


AFTER

$ USE_ZEND_ALLOC=0 valgrind php test.php
[no error]
Comment 5 Petr Gajdos 2015-03-31 12:09:10 UTC 
Testcase and patch works down to 5.2.
Comment 6 Petr Gajdos 2015-04-01 13:45:01 UTC 
Packages submitted.
Comment 9 Andreas Stieger 2015-04-02 12:26:58 UTC 
Could you check the openSUSE submission?
https://build.opensuse.org/request/show/293989

Unfortunately we just released a PHP update which broke the source link. Could you osc pull and re-submit?
Comment 10 Swamp Workflow Management 2015-04-08 14:07:09 UTC 
openSUSE-SU-2015:0684-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 924970,924972,925109
CVE References: CVE-2015-2348,CVE-2015-2787
Sources used:
openSUSE 13.2 (src):    php5-5.6.1-18.1
openSUSE 13.1 (src):    php5-5.4.20-49.1
Comment 12 Swamp Workflow Management 2015-05-13 13:08:05 UTC 
SUSE-SU-2015:0868-1: An update that solves 9 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 922022,922451,922452,923946,924970,924972,925109,928408,928506,928511
CVE References: CVE-2014-9705,CVE-2014-9709,CVE-2015-2301,CVE-2015-2305,CVE-2015-2348,CVE-2015-2783,CVE-2015-2787,CVE-2015-3329,CVE-2015-3330
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    php5-5.5.14-22.1
SUSE Linux Enterprise Module for Web Scripting 12 (src):    php5-5.5.14-22.1
Comment 13 Swamp Workflow Management 2015-06-09 12:05:58 UTC 
SUSE-SU-2015:1018-1: An update that solves 11 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 922022,922451,922452,923946,924972,925109,928506,928511,931421,931769,931772,931776
CVE References: CVE-2014-9705,CVE-2014-9709,CVE-2015-2301,CVE-2015-2305,CVE-2015-2783,CVE-2015-2787,CVE-2015-3329,CVE-2015-4021,CVE-2015-4022,CVE-2015-4024,CVE-2015-4026
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    php53-5.3.17-0.41.1
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    php53-5.3.17-0.41.1
SUSE Linux Enterprise Server 11 SP3 (src):    php53-5.3.17-0.41.1
Comment 14 Marcus Meissner 2015-09-10 15:12:40 UTC 
released
Comment 15 Swamp Workflow Management 2016-06-21 11:13:23 UTC 
SUSE-SU-2016:1638-1: An update that fixes 85 vulnerabilities is now available.

Category: security (important)
Bug References: 884986,884987,884989,884990,884991,884992,885961,886059,886060,893849,893853,902357,902360,902368,910659,914690,917150,918768,919080,921950,922451,922452,923945,924972,925109,928506,928511,931421,931769,931772,931776,933227,935074,935224,935226,935227,935229,935232,935234,935274,935275,938719,938721,942291,942296,945412,945428,949961,968284,969821,971611,971612,971912,973351,973792,976996,976997,977003,977005,977991,977994,978827,978828,978829,978830,980366,980373,980375,981050,982010,982011,982012,982013,982162
CVE References: CVE-2004-1019,CVE-2006-7243,CVE-2014-0207,CVE-2014-3478,CVE-2014-3479,CVE-2014-3480,CVE-2014-3487,CVE-2014-3515,CVE-2014-3597,CVE-2014-3668,CVE-2014-3669,CVE-2014-3670,CVE-2014-4049,CVE-2014-4670,CVE-2014-4698,CVE-2014-4721,CVE-2014-5459,CVE-2014-8142,CVE-2014-9652,CVE-2014-9705,CVE-2014-9709,CVE-2014-9767,CVE-2015-0231,CVE-2015-0232,CVE-2015-0273,CVE-2015-1352,CVE-2015-2301,CVE-2015-2305,CVE-2015-2783,CVE-2015-2787,CVE-2015-3152,CVE-2015-3329,CVE-2015-3411,CVE-2015-3412,CVE-2015-4021,CVE-2015-4022,CVE-2015-4024,CVE-2015-4026,CVE-2015-4116,CVE-2015-4148,CVE-2015-4598,CVE-2015-4599,CVE-2015-4600,CVE-2015-4601,CVE-2015-4602,CVE-2015-4603,CVE-2015-4643,CVE-2015-4644,CVE-2015-5161,CVE-2015-5589,CVE-2015-5590,CVE-2015-6831,CVE-2015-6833,CVE-2015-6836,CVE-2015-6837,CVE-2015-6838,CVE-2015-7803,CVE-2015-8835,CVE-2015-8838,CVE-2015-8866,CVE-2015-8867,CVE-2015-8873,CVE-2015-8874,CVE-2015-8879,CVE-2016-2554,CVE-2016-3141,CVE-2016-3142,CVE-2016-3185,CVE-2016-4070,CVE-2016-4073,CVE-2016-4342,CVE-2016-4346,CVE-2016-4537,CVE-2016-4538,CVE-2016-4539,CVE-2016-4540,CVE-2016-4541,CVE-2016-4542,CVE-2016-4543,CVE-2016-4544,CVE-2016-5093,CVE-2016-5094,CVE-2016-5095,CVE-2016-5096,CVE-2016-5114
Sources used:
SUSE Linux Enterprise Server 11-SP2-LTSS (src):    php53-5.3.17-47.1