Lucene search

MitreCVE-2015-6527

HistoryJan 19, 2016 - 5:59 a.m.

CVE-2015-6527

2016-01-1905:59:01

mitre

web.nvd.nist.gov

cve-2015-6527

php

remote code execution

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

7.5

Confidence

High

EPSS

0.009

Percentile

82.4%

JSON

The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function.

Affected configurations

Nvd

Node

phpphpMatch7.0.0-

phpphpMatch7.0.0alpha1

phpphpMatch7.0.0alpha2

phpphpMatch7.0.0beta1

phpphpMatch7.0.0beta2

phpphpMatch7.0.0beta3

phpphpMatch7.0.0rc1

phpphpMatch7.0.0rc2

phpphpMatch7.0.0rc3

phpphpMatch7.0.0rc4

phpphpMatch7.0.0rc5

phpphpMatch7.0.0rc6

phpphpMatch7.0.0rc7

phpphpMatch7.0.0rc8

VendorProductVersionCPE
phpphp7.0.0cpe:2.3:a:php:php:7.0.0:-:*:*:*:*:*:*
phpphp7.0.0cpe:2.3:a:php:php:7.0.0:alpha1:*:*:*:*:*:*
phpphp7.0.0cpe:2.3:a:php:php:7.0.0:alpha2:*:*:*:*:*:*
phpphp7.0.0cpe:2.3:a:php:php:7.0.0:beta1:*:*:*:*:*:*
phpphp7.0.0cpe:2.3:a:php:php:7.0.0:beta2:*:*:*:*:*:*
phpphp7.0.0cpe:2.3:a:php:php:7.0.0:beta3:*:*:*:*:*:*
phpphp7.0.0cpe:2.3:a:php:php:7.0.0:rc1:*:*:*:*:*:*
phpphp7.0.0cpe:2.3:a:php:php:7.0.0:rc2:*:*:*:*:*:*
phpphp7.0.0cpe:2.3:a:php:php:7.0.0:rc3:*:*:*:*:*:*
phpphp7.0.0cpe:2.3:a:php:php:7.0.0:rc4:*:*:*:*:*:*

Vendor	Product	Version	CPE
php	php	7.0.0	cpe:2.3:a:php:php:7.0.0:-::::::
php	php	7.0.0	cpe:2.3:a:php:php:7.0.0:alpha1::::::
php	php	7.0.0	cpe:2.3:a:php:php:7.0.0:alpha2::::::
php	php	7.0.0	cpe:2.3:a:php:php:7.0.0:beta1::::::
php	php	7.0.0	cpe:2.3:a:php:php:7.0.0:beta2::::::
php	php	7.0.0	cpe:2.3:a:php:php:7.0.0:beta3::::::
php	php	7.0.0	cpe:2.3:a:php:php:7.0.0:rc1::::::
php	php	7.0.0	cpe:2.3:a:php:php:7.0.0:rc2::::::
php	php	7.0.0	cpe:2.3:a:php:php:7.0.0:rc3::::::
php	php	7.0.0	cpe:2.3:a:php:php:7.0.0:rc4::::::

Rows per page:

1-10 of 141

References

git.php.net/?p=php-src.git%3Ba=commit%3Bh=6aeee47b2cd47915ccfa3b41433a3f57aea24dd5

www.openwall.com/lists/oss-security/2015/07/30/11

bugs.php.net/bug.php?id=70140

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

7.5

Confidence

High

EPSS

0.009

Percentile

82.4%

JSON

Related for CVE-2015-6527