CVE-2015-7803

Severity

68%

Complexity

86%

Confidentiality

106%

CWE-476: NULL Pointer Dereference Per Advisory: The attack can lead to remote code execution

The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a .phar file with a crafted TAR archive entry in which the Link indicator references a file that does not exist.

CWE-476: NULL Pointer Dereference Per Advisory: The attack can lead to remote code execution

CVSS 2.0 Base Score 6.8. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P).

Overview

First reported 9 years ago

2015-12-11 12:00:00

Last updated 8 years ago

2016-12-07 18:25:00

Affected Software

PHP PHP

PHP PHP 5.6.1

5.6.1

PHP 5.6.2

5.6.2

PHP 5.6.3

5.6.3

PHP 5.6.4

5.6.4

PHP 5.6.5

5.6.5

PHP 5.6.6

5.6.6

PHP 5.6.7

5.6.7

PHP PHP 5.6.8

5.6.8

PHP PHP 5.6.9

5.6.9

PHP PHP 5.6.10

5.6.10

PHP PHP 5.6.11

5.6.11

PHP PHP 5.6.12

5.6.12

PHP PHP 5.6.13

5.6.13

Apple Mac OS X

References

http://git.php.net/?p=php-src.git;a=commit;h=d698f0ae51f67c9cce870b09c59df3d6ba959244

APPLE-SA-2015-12-08-3

SUSE-SU-2016:1145

openSUSE-SU-2016:0251

openSUSE-SU-2016:0366

DSA-3380

[oss-security] 20151005 CVE request: issues fixed in PHP 5.6.14 and 5.5.30

http://www.php.net/ChangeLog-5.php

76959

SSA:2016-034-04

USN-2786-1

https://bugs.php.net/bug.php?id=69720

Vendor Advisory

GLSA-201606-10

https://support.apple.com/HT205637