NetSight
IP …
medium5.0

CVE-2015-4021

The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of…

Impact

The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.

Affected products

VendorProductAffected versions
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Hpc Node
Version 7.0
RedhatEnterprise Linux Hpc Node Eus
Version 7.1
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Eus
Version 7.1
RedhatEnterprise Linux Workstation
Version 7.0
AppleMac Os X
through 10.10.4
RedhatEnterprise Linux
Versions 6.0, 7.0
PhpPhp
through 5.4.40
Versions 5.4.39, 5.5.0, 5.5.1, 5.5.2, 5.5.3

Weakness classification

CWE-189

References