Withdrawn by the publisher.

Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving (1) ArrayObject, (2) SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled during unserialization.

Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving (1) ArrayObject, (2) SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled during unserialization.

php: segmentation fault in Phar::convertToData on invalid file php: buffer overflow and stack smashing error in phar_fix_filepath php: Use After Free Vulnerability in unserialize() php: dangling pointer in the unserialization of ArrayObject items php: Files from archive can be extracted outside of destination directory using phar php: multiple unserialization use-after-free issues php: use-after-free vulnerability in session deserializer php: SOAP serialize_function_call() type confusion php: NULL pointer dereference in XSLTProcessor class php: NULL pointer dereference in XSLTProcessor class php: NULL pointer dereference in phar_get_fp_offset() php: uninitialized pointer in phar_make_dirstream()

Security update for php5

Affected: Ubuntu:14.04:LTS: php5

Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving (1) ArrayObject, (2) SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled during unserialization.