CVE-2015-2331
Published: 30 March 2015
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.
Notes
| Author | Note |
|---|---|
| mdeslaur | libzip in trusty and earlier doesn't support ZIP64, so doesn't look vulnerable. php5 in utopic and earlier doesn't support ZIP64 either. |
| sbeattie | fixed in libzip 1.0 release |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libzip Launchpad, Ubuntu, Debian |
lucid |
Ignored
(end of life)
|
| precise |
Not vulnerable
(0.10-1ubuntu1)
|
|
| trusty |
Not vulnerable
(0.10.1-1.2)
|
|
| upstream |
Released
(0.11.2-1.2)
|
|
| utopic |
Ignored
(end of life)
|
|
| vivid |
Ignored
(end of life)
|
|
| wily |
Not vulnerable
(1.0.1-0ubuntu1)
|
|
|
Patches: upstream: http://hg.nih.at/libzip/rev/9f11d54f692e |
||
|
php5 Launchpad, Ubuntu, Debian |
lucid |
Not vulnerable
(5.3.2-1ubuntu4.29)
|
| precise |
Not vulnerable
(5.3.10-1ubuntu3.17)
|
|
| trusty |
Not vulnerable
(5.5.9+dfsg-1ubuntu4.7)
|
|
| upstream |
Needs triage
|
|
| utopic |
Not vulnerable
(5.5.12+dfsg-2ubuntu4.3)
|
|
| vivid |
Released
(5.6.4+dfsg-4ubuntu4)
|
|
| wily |
Released
(5.6.4+dfsg-4ubuntu4)
|
|
|
Patches: upstream: http://git.php.net/?p=php-src.git;a=commit;h=4a8d8b4154334b1714e19b82b061201d41dc87d6 |
||