Candidate: CVE-2015-2331
PublicDate: 2015-03-30 10:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2331
 http://www.openwall.com/lists/oss-security/2015/03/18/1
Description:
 Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip
 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39,
 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows
 remote attackers to cause a denial of service (application crash) or
 possibly execute arbitrary code via a ZIP archive that contains many
 entries, leading to a heap-based buffer overflow.
Ubuntu-Description:
Notes:
 mdeslaur> libzip in trusty and earlier doesn't support ZIP64, so doesn't
 mdeslaur> look vulnerable.
 mdeslaur> php5 in utopic and earlier doesn't support ZIP64 either.
 sbeattie> fixed in libzip 1.0 release
Bugs:
 https://bugs.php.net/bug.php?id=69253
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780713 (php5)
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780756 (libzip)
Priority: medium
Discovered-by:
Assigned-to:
CVSS: 

Patches_php5:
 upstream: http://git.php.net/?p=php-src.git;a=commit;h=4a8d8b4154334b1714e19b82b061201d41dc87d6
upstream_php5: needs-triage
lucid_php5: not-affected (5.3.2-1ubuntu4.29)
precise_php5: not-affected (5.3.10-1ubuntu3.17)
trusty_php5: not-affected (5.5.9+dfsg-1ubuntu4.7)
trusty/esm_php5: not-affected (5.5.9+dfsg-1ubuntu4.7)
utopic_php5: not-affected (5.5.12+dfsg-2ubuntu4.3)
vivid_php5: released (5.6.4+dfsg-4ubuntu4)
vivid/stable-phone-overlay_php5: DNE
vivid/ubuntu-core_php5: DNE
wily_php5: released (5.6.4+dfsg-4ubuntu4)
devel_php5: DNE

Patches_libzip:
 upstream: http://hg.nih.at/libzip/rev/9f11d54f692e
upstream_libzip: released (0.11.2-1.2)
lucid_libzip: ignored (reached end-of-life)
precise_libzip: not-affected (0.10-1ubuntu1)
trusty_libzip: not-affected (0.10.1-1.2)
trusty/esm_libzip: not-affected (0.10.1-1.2)
utopic_libzip: ignored (reached end-of-life)
vivid_libzip: ignored (reached end-of-life)
vivid/stable-phone-overlay_libzip: DNE
vivid/ubuntu-core_libzip: DNE
wily_libzip: not-affected (1.0.1-0ubuntu1)
devel_libzip: not-affected (1.0.1-0ubuntu1)