CVE-2015-2783
Published: 17 April 2015
ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.
Priority
Status
Package | Release | Status |
---|---|---|
php5 Launchpad, Ubuntu, Debian |
upstream |
Needs triage
|
lucid |
Released
(5.3.2-1ubuntu4.30)
|
|
precise |
Released
(5.3.10-1ubuntu3.18)
|
|
trusty |
Released
(5.5.9+dfsg-1ubuntu4.9)
|
|
utopic |
Released
(5.5.12+dfsg-2ubuntu4.4)
|
|
Patches: upstream: http://git.php.net/?p=php-src.git;a=commit;h=9faaee66fa493372c7340b1ab05f8fd115131a42 (5.4,5.5,5.6) upstream: http://git.php.net/?p=php-src.git;a=commit;h=12d3bdee3dfa6605024a72080d8a17c165c5ed24 (5.4,5.5,5.6) |