CVE-2015-2787

highPriorität · verfolgen · 34EPSS 0.118 · 96. PerzentilDEEURUUS
grimoire priorityP1 · Urgent
Exploitable?
—
no known exploitation
Likely / severe?
11.8% (96th) EPSS
CVSS 7.5 · high
Is it mine?
70 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · ads_tec_psirt

EPSS · bewertet 2026-10-27

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenMES PCfesto_psirt

    Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.

  • Behobenads_tec_psirt

    Update firmware to the latest version available. The issues have been resolved with IRF1000 version 1.5.0, IRF2000 version 4.4.0 and IRF3000 version 1.2.0.

  • BehobenMES PCcisa_csaf_ot

    Festo Didactic has released Factory Control Panel as a replacement for XAMPP on its MES PCs. Contact technical support at services.didactic@festo.com to obtain the current version of Factory Control Panel which includes fixes for these vulnerabilities.

  • Mitigationads_tec_psirt

    It is recommended to disable all user accounts with restricted configuration write permissions if the update to the latest released version cannot be installed immediately.It is further recommended to use best practice password policies.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 6.4–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4
v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Psecondary · CISA US
v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Psecondary · FSTEC (BDU) RU
v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Psecondary · Festo PSIRT DE
v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:P/E:Usecondary · CVSS-BT (t0sche)
v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Festo PSIRT DE
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-416USCWE-416USCWE-416US
04

betroffene Produkte (70)

Betroffene Produkte und Versionsbereiche.

20 von 70 angezeigt
05

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

  • FSA-202402Several Vulnerabilities in MES PC (Windows 10)2024-02-27csaf · festo_psirtDE

    MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications. MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.

  • VDE-2023-009ads-tec: Multiple Vulnerabilities in IRF1000, IRF2000 and IRF30002023-05-08csaf · ads_tec_psirtDE

    The affected products integrate the vulnerable libraries in a way so that the vulnerabilities can't be exploited remotely without prior authentication.

  • WID-SEC-W-2023-0069PHP: Mehrere SchwachstellenDeutsch2015-03-30csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen oder einen Denial of Service Zustand herbeizuführen.

  • ICSA-26-027-02Festo Didactic SE MES PC2024-02-27icsa · cisa_csaf_otUS

    MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications. MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.

06

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bduads_tec_psirtcert_bundcisa_csaf_otfesto_psirtNVDCVE.orgMITRE
veröffentlicht 2015-03-30geändert 2026-06-17
08

Referenzen (45)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan