CVE-2015-7804

Severity

68%

Complexity

86%

Confidentiality

106%

Per Advisory: The attack can lead to remote code execution

Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (uninitialized pointer dereference and application crash) by including the / filename in a .zip PHAR archive.

Per Advisory: The attack can lead to remote code execution

CVSS 2.0 Base Score 6.8. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P).

Overview

First reported 9 years ago

2015-12-11 12:00:00

Last updated 8 years ago

2016-12-07 18:25:00

Affected Software

Apple Mac OS X

PHP PHP

PHP 5.6.0

5.6.0

PHP PHP 5.6.1

5.6.1

PHP 5.6.2

5.6.2

PHP 5.6.3

5.6.3

PHP 5.6.4

5.6.4

PHP 5.6.5

5.6.5

PHP 5.6.6

5.6.6

PHP 5.6.7

5.6.7

PHP PHP 5.6.8

5.6.8

PHP PHP 5.6.9

5.6.9

PHP PHP 5.6.10

5.6.10

PHP PHP 5.6.11

5.6.11

PHP PHP 5.6.12

5.6.12

PHP PHP 5.6.13

5.6.13

References

http://git.php.net/?p=php-src.git;a=commit;h=1ddf72180a52d247db88ea42a3e35f824a8fbda1

APPLE-SA-2015-12-08-3

openSUSE-SU-2016:0251

DSA-3380

[oss-security] 20151005 CVE request: issues fixed in PHP 5.6.14 and 5.5.30

http://www.php.net/ChangeLog-5.php

76959

SSA:2016-034-04

USN-2786-1

https://bugs.php.net/bug.php?id=70433

Vendor Advisory

GLSA-201606-10

https://support.apple.com/HT205637