$ cve CVE-2015-4600 JSON

CVE-2015-4600

9.8

CRITICAL · CVSS 3.0 · EPSS 10.7% (pctl 96)

Patch early

EPSS 10.7% — above the 10% action threshold.

Description

The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods.

Scoring

CVSS	9.8 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	10.72% — more likely to be exploited than 96% of all CVEs
On CISA KEV	no
Public exploit	none known
Published	2016-05-16
Last modified	2026-06-17

Affected (7)

Vendor	Product
php	php
redhat	enterprise linux desktop
redhat	enterprise linux hpc node
redhat	enterprise linux hpc node eus
redhat	enterprise linux server
redhat	enterprise linux server eus
redhat	enterprise linux workstation

References

→ the Explorer · watch your stack · NVD