How severe is CVE-2015-1351?

CVE-2015-1351 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2015-1351 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 9% (94th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-1351?

CVE-2015-1351 primarily affects Oracle Secure Backup. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-1351?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2015-1351 published?

CVE-2015-1351 was published on 2015-03-30 and last updated on 2026-06-17.

CVE-2015-1351

CVE-2015-1351 is a high-severity vulnerability in Oracle Secure Backup with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-416.

Key facts

Severity: High (CVSS 2.0 base score 7.5)
EPSS exploit prediction: 9% (94th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-416
Affected product: Oracle Secure Backup
Published: 2015-03-30
Last modified: 2026-06-17

Description

Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Frequently asked questions

What is CVE-2015-1351?: Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
How severe is CVE-2015-1351?: CVE-2015-1351 has a CVSS 2.0 base score of 7.5, rated high severity.
Is CVE-2015-1351 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 9% (94th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-1351?: CVE-2015-1351 primarily affects Oracle Secure Backup. In total, 6 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-1351?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2015-1351 published?: CVE-2015-1351 was published on 2015-03-30 and last updated on 2026-06-17.

References

Affected products (6)

cpe:2.3:a:oracle:secure_backup:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*
cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*

More vulnerabilities in Oracle Secure Backup

CVE-2011-2261 — Critical (CVSS 10.0): Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.3.0.3 allows remote…
CVE-2010-0907 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect confidentiality,…
CVE-2010-0898 — Critical (CVSS 10.0): Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect confidentiality,…
CVE-2010-0072 — Critical (CVSS 10.0): Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote…
CVE-2009-1977 — Critical (CVSS 10.0): Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote…
CVE-2008-5449 — Critical (CVSS 10.0): Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote…

All CVEs affecting Oracle Secure Backup →

Other CWE-416 (Use After Free) vulnerabilities

CVE-2026-13782 — Critical (CVSS 10.0): Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the…
CVE-2026-4725 — Critical (CVSS 10.0): Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149…
CVE-2026-4688 — Critical (CVSS 10.0): Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox…
CVE-2025-24085 — Critical (CVSS 10.0): A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3,…
CVE-2024-43102 — Critical (CVSS 10.0): Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of…
CVE-2021-32495 — Critical (CVSS 10.0): Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory…

Browse all CWE-416 (Use After Free) vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

45.84.120.3 (ipv4-addr)
79.137.34.248 (ipv4-addr)
221.161.235.168 (ipv4-addr)
200.196.50.91 (ipv4-addr)
187.51.208.158 (ipv4-addr)
187.141.71.166 (ipv4-addr)
187.110.238.50 (ipv4-addr)
113.164.66.10 (ipv4-addr)