NetSight
IP …
critical9.8

CVE-2015-4643

Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to e…

Impact

Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.

Affected products

VendorProductAffected versions
PhpPhp
before 5.4.42
from 5.5.0 before 5.5.26
from 5.6.0 before 5.6.10
DebianDebian Linux
Versions 7.0, 8.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 6.6, 7.3, 7.4, 7.6
RedhatEnterprise Linux Server Eus
Versions 6.6, 7.1, 7.2, 7.3, 7.4, 7.5
RedhatEnterprise Linux Server Tus
Versions 6.6, 7.3, 7.6
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
OracleLinux
Versions 6, 7

Weakness classification

CWE-119

References