PT-2016-2109 · Php · Php

Publicado 2016-05-21 · Atualizado 2019-02-14 · CVE-2015-8878

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.5.28 PHP versions 5.6.x prior to 5.6.12

Description The issue is caused by errors in synchronization when using a shared resource in the main/php open temporary file.c function of the PHP interpreter. This allows remote attackers to cause a denial of service by exploiting a race condition and heap memory corruption, leveraging an application that performs many temporary-file accesses.

Recommendations For PHP versions prior to 5.5.28, update to version 5.5.28 or later. For PHP versions 5.6.x prior to 5.6.12, update to version 5.6.12 or later.

Correção

DoS

Race Condition

Buffer Overflow

Enumeração de Fraquezas

CWE-362

CWE-119

Identificadores relacionados

BDU:2016-01461

CVE-2015-8878

DLA-499-1

Produtos afetados

Php

Referências · 7

• http://php.net/ChangeLog-5.php#5.5.28 · Nota
• https://bdu.fstec.ru/vul/2016-01461 · Nota de Segurança
• http://php.net/ChangeLog-5.php#5.6.12 · Nota
• http://php.net/ChangeLog-5.php · Aviso do Fabricante
• https://bugs.php.net/bug.php?id=70002 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8878 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8878 · Nota de Segurança