CVE-2015-4021
Published: 9 June 2015
The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
php5 Launchpad, Ubuntu, Debian |
precise |
Released
(5.3.10-1ubuntu3.19)
|
| trusty |
Released
(5.5.9+dfsg-1ubuntu4.11)
|
|
| upstream |
Released
(5.4.41,5.5.25,5.6.9)
|
|
| utopic |
Released
(5.5.12+dfsg-2ubuntu4.6)
|
|
| vivid |
Released
(5.6.4+dfsg-4ubuntu6.2)
|
|
|
Patches: upstream: http://git.php.net/?p=php-src.git;a=commit;h=c27f012b7a447e59d4a704688971cbfa7dddaa74 upstream: http://git.php.net/?p=php-src.git;a=commit;h=e2bbf0a2df2cd864fa86d613eb316b249811a6f6 |
||