Lucene search

[email protected]CVE-2015-7803

HistoryDec 11, 2015 - 12:00 p.m.

CVE-2015-7803

2015-12-1112:00:11

[email protected]

web.nvd.nist.gov

111

cve-2015-7803

php

phar_get_entry_data

remote

denial of service

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.7 High

AI Score

Confidence

High

0.066 Low

EPSS

Percentile

93.9%

JSON

The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a .phar file with a crafted TAR archive entry in which the Link indicator references a file that does not exist.

Affected configurations

NVD

Node

phpphpRange≤5.5.29

phpphpMatch5.6.1

phpphpMatch5.6.2

phpphpMatch5.6.3

phpphpMatch5.6.4

phpphpMatch5.6.5

phpphpMatch5.6.6

phpphpMatch5.6.7

phpphpMatch5.6.8

phpphpMatch5.6.9

phpphpMatch5.6.10

phpphpMatch5.6.11

phpphpMatch5.6.12

phpphpMatch5.6.13

Node

applemac_os_xRange≤10.11.1

CPENameOperatorVersion
php:phpphple5.5.29
php:phpphpeq5.6.1
php:phpphpeq5.6.2
php:phpphpeq5.6.3
php:phpphpeq5.6.4
php:phpphpeq5.6.5
php:phpphpeq5.6.6
php:phpphpeq5.6.7
php:phpphpeq5.6.8
php:phpphpeq5.6.9

CPE	Name	Operator	Version
php:php	php	le	5.5.29
php:php	php	eq	5.6.1
php:php	php	eq	5.6.2
php:php	php	eq	5.6.3
php:php	php	eq	5.6.4
php:php	php	eq	5.6.5
php:php	php	eq	5.6.6
php:php	php	eq	5.6.7
php:php	php	eq	5.6.8
php:php	php	eq	5.6.9