NetSight
IP …
medium5.8

CVE-2015-2783

ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory o…

Impact

ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.

Affected products

VendorProductAffected versions
PhpPhp
through 5.4.39
Versions 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Hpc Node
Version 7.0
RedhatEnterprise Linux Hpc Node Eus
Version 7.1
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Eus
Version 7.1
RedhatEnterprise Linux Workstation
Version 7.0
RedhatEnterprise Linux
Versions 6.0, 7.0
AppleMac Os X
through 10.10.5

Weakness classification

CWE-119

References