CVE-2015-9253

Published: 19 February 2018

An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.

Notes

Author	Note
leosilva	in 7.0 upstream patch caused a regression according with upstream that is the possible the missing patch: https://github.com/php/php-src/commit/cc5c51e7f0732067f105d13c6d355fcab5965c2f
rodrigo-zaiden	php7.0 for xenial was released with above patch.

Author

Note

leosilva

in 7.0 upstream patch caused a regression
according with upstream that is the possible
the missing patch: https://github.com/php/php-src/commit/cc5c51e7f0732067f105d13c6d355fcab5965c2f

rodrigo-zaiden

php7.0 for xenial was released with above patch.

Priority

Cvss 3 Severity Score

6.5

Score breakdown

Status

Package	Release	Status
php5 Launchpad, Ubuntu, Debian	xenial	Does not exist
	artful	Does not exist
	upstream	Needs triage
	trusty	Released (5.5.9+dfsg-1ubuntu4.29+esm10)
	bionic	Does not exist
	cosmic	Does not exist
	disco	Does not exist
	eoan	Does not exist
	focal	Does not exist
	impish	Does not exist
	groovy	Does not exist
	jammy	Does not exist
	hirsute	Does not exist
php7.0 Launchpad, Ubuntu, Debian	trusty	Does not exist
	artful	Does not exist
	bionic	Does not exist
	cosmic	Does not exist
	disco	Does not exist
	eoan	Does not exist
	focal	Does not exist
	xenial	Released (7.0.33-0ubuntu0.16.04.16+esm3)
	impish	Does not exist
	upstream	Needed
	groovy	Does not exist
	jammy	Does not exist
	hirsute	Does not exist
	Patches: upstream: https://github.com/php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8 upstream: https://github.com/php/php-src/commit/cc5c51e7f0732067f105d13c6d355fcab5965c2f
php7.2 Launchpad, Ubuntu, Debian	upstream	Released (7.2.8)
	trusty	Does not exist
	xenial	Does not exist
	artful	Does not exist
	bionic	Released (7.2.10-0ubuntu0.18.04.1)
	cosmic	Released (7.2.10-0ubuntu1)
	disco	Released (7.2.10-0ubuntu1)
	eoan	Does not exist
	focal	Does not exist
	impish	Does not exist
	groovy	Does not exist
	jammy	Does not exist
	hirsute	Does not exist
	Patches: upstream: http://git.php.net/?p=php-src.git;a=commit;h=69dee5c732fe982c82edb17d0dbc3e79a47748d8
php7.3 Launchpad, Ubuntu, Debian	upstream	Needs triage
	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	eoan	Not vulnerable
	focal	Does not exist
	impish	Does not exist
	groovy	Does not exist
	jammy	Does not exist
	hirsute	Does not exist

Severity score breakdown

Parameter	Value
Base score	6.5
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›