CVE catalog

CVE-2010-2225

apache2-mod_php5-5.6.28-1.1 on GA media

Severity: Unknown
Published: Jun 18, 2010, 12:00:00 AM UTC
Updated: Mar 9, 2026, 1:19:06 AM UTC
Source: [NVD] · [CVE record]
EPSS: 5.34% · Oct 25, 2026

Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obtain sensitive information via serialized data, related to the PHP unserialize function.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	php5	5.0	`5.2.6.dfsg.1-1+lenny2`	vulnerable
Debian	php5	5.0	`5.2.6.dfsg.1-1+lenny3`	vulnerable
Debian	php5	5.0	`5.2.6.dfsg.1-1+lenny4`	vulnerable
Debian	php5	5.0	`5.2.6.dfsg.1-1+lenny6`	vulnerable
Debian	php5	5.0	`5.2.6.dfsg.1-1+lenny8`	vulnerable
Debian	php5	5.0	`5.2.6.dfsg.1-1+lenny9`	fixed
Opensuse	php7	tumbleweed	`7.0.14-1.4`	fixed
Opensuse	php5	tumbleweed	`5.6.28-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	php5	deb	5.0	`5.2.6.dfsg.1-1+lenny9`	Not reported	DSA-2089-1	Not reported
Opensuse	php7	rpm	tumbleweed	`7.0.14-1.4`	Not reported	OPENSUSE-SU-2024:10290-1	Not reported
Opensuse	php5	rpm	tumbleweed	`5.6.28-1.1`	Not reported	OPENSUSE-SU-2024:10344-1	Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 23, 2026, 5:04:57 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]