Which products and versions are affected by CVE-2015-0273?

Affected: PHP versions 5.5.0, 5.5.0-alpha1, 5.5.0-alpha2, 5.5.0-alpha3, 5.5.0-alpha4, 5.5.0-alpha5, 5.5.0-alpha6, 5.5.0-beta1; php5 (debian); php54-bcmath (amazon), among others. The full list is in the CVE brief.

Is CVE-2015-0273 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2015-0273 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2015-0273?

A public exploit is reported by tracking sources, but no code link is listed yet.

Is there a fix for CVE-2015-0273?

Fixed versions are available, including apache2-mod_php5 5.5.14-15.1, apache2-mod_php5 5.6.28-1.1, apache2-mod_php53 5.3.17-47.1.

How urgently should CVE-2015-0273 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

WatchlistHigh

CVE-2015-0273PHP Use-After-Free

php: use after free vulnerability in unserialize() with DateTimeZone

Published Feb 19, 2015 · Updated Apr 22, 2026 · Also known as UBUNTU-CVE-2015-0273

Key Facts

Patch immediately

CVE-2015-0273 is a high-severity vulnerability (CVSS 7.5 v2) affecting PHP, php5 (debian), php54-bcmath (amazon) and 22 more products.
It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
EPSS estimates a 44% probability of exploitation in the next 30 days.
Fixed versions are available, including apache2-mod_php5 5.5.14-15.1, apache2-mod_php5 5.6.28-1.1, apache2-mod_php53 5.3.17-47.1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v2

7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS (30-day exploit likelihood)

44%

Higher than 98.7% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

44/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://ubuntu.com/security/CVE-2015-0273
advisoryhttps://www.cve.org/CVERecord?id=CVE-2015-0273
advisoryRHSA-2015:1053
advisoryRHSA-2015:1066
advisoryRHSA-2015:1135
advisoryRHSA-2015:1218

Description

Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the php_date_initialize_from_hash function.

Affected Products

549 affected entries in total

Product	Affected versions	Fixed in
PHPPHP	5.5.0, 5.5.0-alpha1, 5.5.0-alpha2, 5.5.0-alpha3, 5.5.0-alpha4, 5.5.0-alpha5, 5.5.0-alpha6, 5.5.0-beta1	5.4.37
php5debian	See advisory	5.4.38-0+deb7u1
php54-bcmathamazon	See advisory	5.4.38-1.66.amzn1
php54-cliamazon	See advisory	5.4.38-1.66.amzn1
php54-commonamazon	See advisory	5.4.38-1.66.amzn1

20 more affected products in the full CVE brief

Patched Releases

apache2-mod_php5

5.5.14-15.1, 5.6.28-1.1

apache2-mod_php53

5.3.17-47.1

apache2-mod_php7

7.0.14-1.4

PHP

0:5.3.3-46.el6_6, 0:5.4.16-36.ael7b_1, 5.3.3-46.el6_6, 5.4.16-36.el7_1, 5.4.37

php-bcmath