PT-2016-2109 · Php · Php

Published 2016-05-21 · Updated 2019-02-14 · CVE-2015-8878

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.5.28 PHP versions 5.6.x prior to 5.6.12

Description The issue is caused by errors in synchronization when using a shared resource in the main/php open temporary file.c function of the PHP interpreter. This allows remote attackers to cause a denial of service by exploiting a race condition and heap memory corruption, leveraging an application that performs many temporary-file accesses.

Recommendations For PHP versions prior to 5.5.28, update to version 5.5.28 or later. For PHP versions 5.6.x prior to 5.6.12, update to version 5.6.12 or later.

Fix

DoS

Race Condition

Buffer Overflow

Weakness Enumeration

CWE-362

CWE-119

Related Identifiers

BDU:2016-01461

CVE-2015-8878

DLA-499-1

Affected Products

Php

References · 7

• https://bdu.fstec.ru/vul/2016-01461 · Security Note
• http://php.net/ChangeLog-5.php · Vendor Advisory
• https://bugs.php.net/bug.php?id=70002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8878 · Security Note
• http://php.net/ChangeLog-5.php#5.5.28 · Note
• http://php.net/ChangeLog-5.php#5.6.12 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8878 · Note