PT-2015-3240 · Php+4 · Php+4

Max Spelsberg

·

Publicado

2015-06-18

·

Atualizado

2019-12-27

·

CVE-2015-4643

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.42 PHP versions 5.5.x prior to 5.5.26 PHP versions 5.6.x prior to 5.6.10
Description The issue is caused by an integer overflow in the ftp genlist function, allowing remote FTP servers to execute arbitrary code via a long reply to a LIST command. This leads to a heap-based buffer overflow. The estimated number of potentially affected devices worldwide is not specified.
Recommendations For PHP versions prior to 5.4.42, update to version 5.4.42 or later. For PHP versions 5.5.x prior to 5.5.26, update to version 5.5.26 or later. For PHP versions 5.6.x prior to 5.6.10, update to version 5.6.10 or later.

Exploit

Correção

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2016-01362
CESA-2015_1135
CVE-2015-4643
DLA-307-1
DSA-3344-1
MGASA-2015-0258
OPENSUSE-SU-2015_1197-1
RHSA-2015:1135
RHSA-2015:1186
RHSA-2015:1187
RHSA-2015:1218
RHSA-2015:1219
RHSA-2015_1135
RHSA-2015_1218
SUSE-SU-2015:1253-1
SUSE-SU-2015:1253-2
SUSE-SU-2016:1638-1
USN-2658-1

Produtos afetados

Centos
Php
Red Hat
Suse
Ubuntu