blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2015-3329

HIGH 7.5 CVSS 2.0
Published
June 9, 2015
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-119
CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.

Affected products and versions

  • PHP — Up to and including 5.4.39
  • PHP versions 5.5.0, 5.5.0alpha1, 5.5.0alpha2, 5.5.0alpha3, 5.5.0alpha4, 5.5.0alpha5, 5.5.0alpha6, 5.5.0beta1, 5.5.0beta2, 5.5.0beta3, 5.5.0beta4, 5.5.0rc1, 5.5.0rc2, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.14, 5.5.18, 5.5.19, 5.5.20, 5.5.21, 5.5.22, 5.5.23, 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7

References

  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=f59b67ae50064560d7bfcdb0d6a8ab284179053c
  • lists.apple.com http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html Mailing List, Vendor Advisory
  • lists.apple.com http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html Mailing List, Vendor Advisory
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00004.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html
  • php.net http://php.net/ChangeLog-5.php Patch
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1066.html
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1135.html Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1186.html
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1187.html Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1218.html
  • www.debian.org http://www.debian.org/security/2015/dsa-3280
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html Third Party Advisory
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html Third Party Advisory
  • www.securityfocus.com http://www.securityfocus.com/bid/74240
  • www.securitytracker.com http://www.securitytracker.com/id/1032145
  • www.ubuntu.com http://www.ubuntu.com/usn/USN-2572-1
  • bugs.php.net https://bugs.php.net/bug.php?id=69441 Exploit, Patch
  • security.gentoo.org https://security.gentoo.org/glsa/201606-10
  • support.apple.com https://support.apple.com/HT205267 Third Party Advisory
  • support.apple.com https://support.apple.com/kb/HT205031 Third Party Advisory
  • nvd.nist.gov Official NVD record