CVE-2015-0273

53

FAUCET Score

CVE-2015-0273 is a critical use-after-free vulnerability affecting PHP versions prior to 5.4.38, 5.5.22, and 5.6.6. It allows remote attackers to execute arbitrary code by sending specially crafted serialized input containing 'R' or 'r' type specifiers to DateTimeZone or DateTime functions. With a CVSS score of 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) and a FAUCET Risk Score of 98/100, this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to full compromise. While not listed in CISA KEV, public exploit code exists on ExploitDB, though there is minimal community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 5.4.37CPE matchmatch criteria	cpe:2.3:a:php:php::::::::
		5.5.0CPE matchmatch criteria	cpe:2.3:a:php:php:5.5.0:::::::*
		5.5.0CPE matchmatch criteria	cpe:2.3:a:php:php:5.5.0:alpha1::::::
		5.5.0CPE matchmatch criteria	cpe:2.3:a:php:php:5.5.0:alpha2::::::
		5.5.0CPE matchmatch criteria	cpe:2.3:a:php:php:5.5.0:alpha3::::::

CVSS Data

CVSS version used by this source: 2.0

7.5HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Exploitability Score

10.0

Impact Score

6.4

CvssVersion

2.0

Exploit Intelligence

EPSS Score

42.91%

Probability of exploitation in next 30 days

EPSS Percentile

98.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

ExploitDB: EDB-36158 · Feb 23, 2015

This CVE's current EPSS score of 0.4291 is in the 97th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (25)

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: php-0:5.3.3-46.el6_6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: php-0:5.4.16-36.el7_1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: php55-0:2.0-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: php55-php-0:5.5.21-2.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: php54-0:2.0-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: php54-php-0:5.4.40-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: php54-php-pecl-zendopcache-0:7.0.4-3.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: php55-0:2.0-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: php55-php-0:5.5.21-2.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: php54-0:2.0-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: php54-php-0:5.4.40-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: php54-php-pecl-zendopcache-0:7.0.4-3.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: php55-0:2.0-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: php55-php-0:5.5.21-2.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: php54-0:2.0-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: php54-php-0:5.4.40-1.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: php54-php-pecl-zendopcache-0:7.0.4-3.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: php55-0:2.0-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: php55-php-0:5.5.21-2.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: php54-0:2.0-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: php54-php-0:5.4.40-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: php54-php-pecl-zendopcache-0:7.0.4-3.el7

redhatno patchvia redhat_api

Product: Red Hat Software CollectionsFixed in: php54-php

redhatno patchvia redhat_api

Product: Red Hat Software CollectionsFixed in: php55-php

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: php53

Vendor Advisories (1)

redhatCVE-2015-0273Moderate

php: use after free vulnerability in unserialize() with DateTimeZone

References

lists.apple.com / archives/security-announce/2015/Jun/msg00002.html

lists.apple.com / archives/security-announce/2015/Oct/msg00005.html

lists.apple.com / archives/security-announce/2015/Sep/msg00008.html

lists.opensuse.org / opensuse-security-announce/2015-03/msg00002.html

lists.opensuse.org / opensuse-security-announce/2015-03/msg00003.html

lists.opensuse.org / opensuse-security-announce/2015-03/msg00004.html

php.net / ChangeLog-5.php

rhn.redhat.com / errata/RHSA-2015-1053.html

rhn.redhat.com / errata/RHSA-2015-1066.html

rhn.redhat.com / errata/RHSA-2015-1135.html

rhn.redhat.com / errata/RHSA-2015-1218.html

bugs.php.net / bug.php

Exploit

bugzilla.redhat.com / show_bug.cgi

security.gentoo.org / glsa/201606-10

support.apple.com / HT205267

support.apple.com / HT205375

support.apple.com / kb/HT204942

debian.org / security/2015/dsa-3195

mandriva.com / security/advisories

oracle.com / technetwork/topics/security/bulletinjul2015-2511963.html

oracle.com / technetwork/topics/security/linuxbulletinjan2016-2867209.html

securityfocus.com / bid/72701

securitytracker.com / id/1031945

ubuntu.com / usn/USN-2535-1