| Package | Affected versions | Patched versions |
|---|---|---|
| php | = 5.5.0= 5.5.1= 5.5.10= 5.5.11= 5.5.12= 5.5.13= 5.5.14= 5.5.18= 5.5.19= 5.5.2= 5.5.20= 5.5.21= 5.5.22= 5.5.3= 5.5.4= 5.5.5= 5.5.6= 5.5.7= 5.5.8= 5.5.9= 5.6.0= 5.6.2= 5.6.3= 5.6.4= 5.6.5= 5.6.6≤ 5.4.38 |
The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free