medium6.5
CVE-2015-9253
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20.
Impact
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Php | Php | before 7.1.20 from 7.2.0 before 7.2.8 Version 7.3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugs.php.net/bug.php?id=70185
- https://bugs.php.net/bug.php?id=73342https://github.com/php/php-src/pull/3287
- https://bugs.php.net/bug.php?id=75968
- https://github.com/php/php-src/blob/PHP-7.1.20/NEWS#L20-L22
- https://github.com/php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8
- https://usn.ubuntu.com/3766-1/
- https://usn.ubuntu.com/4279-1/
- https://www.futureweb.at/security/CVE-2015-9253/
- https://bugs.php.net/bug.php?id=70185
- https://bugs.php.net/bug.php?id=73342https://github.com/php/php-src/pull/3287
- https://bugs.php.net/bug.php?id=75968
- https://github.com/php/php-src/blob/PHP-7.1.20/NEWS#L20-L22
- https://github.com/php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8
- https://usn.ubuntu.com/3766-1/
- https://usn.ubuntu.com/4279-1/
- https://www.futureweb.at/security/CVE-2015-9253/