TI-2015-03457 Aliases CVE-2015-4116 GHSA-6648-4fcr-v6ch

Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in…

MEDIUM 50Published 2016-05-16 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.

Why it matters now

EPSS 0.05466 92nd percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPE	Versions	Role	Vendor
cpe:2.3:o:opensuse:leap:42.1:::::::*	42.1	Vulnerable	openSUSE
cpe:2.3:a:php:php::::::::	up to 5.5.26	Vulnerable	PHP
cpe:2.3:a:php:php:5.6.0:::::::*	5.6.0	Vulnerable	PHP
cpe:2.3:a:php:php:5.6.1:::::::*	5.6.1	Vulnerable	PHP
cpe:2.3:a:php:php:5.6.2:::::::*	5.6.2	Vulnerable	PHP
cpe:2.3:a:php:php:5.6.3:::::::*	5.6.3	Vulnerable	PHP
cpe:2.3:a:php:php:5.6.4:::::::*	5.6.4	Vulnerable	PHP
cpe:2.3:a:php:php:5.6.5:::::::*	5.6.5	Vulnerable	PHP
cpe:2.3:a:php:php:5.6.6:::::::*	5.6.6	Vulnerable	PHP
cpe:2.3:a:php:php:5.6.7:::::::*	5.6.7	Vulnerable	PHP

cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* Versions 42.1 Vulnerable ·openSUSE
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions up to 5.5.26 Vulnerable ·PHP
cpe:2.3:a:php:php:5.6.0:*:*:*:*:*:*:* Versions 5.6.0 Vulnerable ·PHP
cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:* Versions 5.6.1 Vulnerable ·PHP
cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:* Versions 5.6.2 Vulnerable ·PHP
cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:* Versions 5.6.3 Vulnerable ·PHP
cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:* Versions 5.6.4 Vulnerable ·PHP
cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:* Versions 5.6.5 Vulnerable ·PHP
cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:* Versions 5.6.6 Vulnerable ·PHP
cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:* Versions 5.6.7 Vulnerable ·PHP

Show 3 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:php:php:5.6.8:::::::*	5.6.8	Vulnerable	PHP
cpe:2.3:a:php:php:5.6.9:::::::*	5.6.9	Vulnerable	PHP
cpe:2.3:a:php:php:5.6.10:::::::*	5.6.10	Vulnerable	PHP

cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:* Versions 5.6.8 Vulnerable ·PHP
cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:* Versions 5.6.9 Vulnerable ·PHP
cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:* Versions 5.6.10 Vulnerable ·PHP

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 5	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix
Red Hat Software Collections	Affected	No fix planned: Will not fix

Not affected: 1 product

Red Hat Enterprise Linux 5

Timeline

2026-10-02 Threatist record created from CVE-2015-4116
2026-10-03 Alias added: GHSA-6648-4fcr-v6ch

References

Exploit 2

Advisory 1

openSUSE-SU-2016:1524

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences