PT-2015-3238 · Php+2 · Php+2

Kwrnel · Published 2015-07-20 · Updated 2017-11-04 · CVE-2015-5589

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.43 PHP versions 5.5.x prior to 5.5.27 PHP versions 5.6.x prior to 5.6.11

Description The issue exists due to a lack of validation of a file pointer before it is closed in the phar convert to other function. This can be exploited by a remote attacker using a specially crafted TAR archive, potentially leading to a denial of service or other unspecified impacts.

Recommendations For PHP versions prior to 5.4.43, update to version 5.4.43 or later. For PHP versions 5.5.x prior to 5.5.27, update to version 5.5.27 or later. For PHP versions 5.6.x prior to 5.6.11, update to version 5.6.11 or later.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-01360

CVE-2015-5589

DLA-307-1

DSA-3344-1

MGASA-2015-0276

RHSA-2016:0457

SUSE-SU-2015:1425-1

SUSE-SU-2015:1466-1

SUSE-SU-2015_1425-1

SUSE-SU-2015_1466-1

SUSE-SU-2016:1638-1

USN-2758-1

Affected Products

Php

Suse

Ubuntu

References · 246

• 🔥 https://github.com/ockeghem/CVE-2015-6835-checker · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5589 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6837 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6835 · Security Note
• https://ubuntu.com/security/CVE-2015-5589 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-6837 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01371 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6831 · Security Note
• https://advisories.mageia.org/MGASA-2015-0276.html · Security Note
• https://ubuntu.com/security/CVE-2015-5590 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1466-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-6831 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6832 · Security Note
• https://bdu.fstec.ru/vul/2016-01360 · Security Note
• https://osv.dev/vulnerability/DSA-3344-1 · Vendor Advisory