The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php | Aug 30, 2017 | Jun 9, 2015 |
| Apple Osx Apache | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Aug 28, 2015 | Jun 9, 2015 |
| Apple Osx Apachemodphp | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Mar 29, 2016 | Jun 9, 2015 |
| Centos_linux | — | Upgrade phpUpgrade php-ztsUpgrade php-embeddedUpgrade php-pdoUpgrade php-commonUpgrade php-odbcUpgrade php-bcmathUpgrade php-enchantUpgrade php-ldapUpgrade php-xmlUpgrade php-recodeUpgrade php-fpmUpgrade php-develUpgrade php-cliUpgrade php-intlUpgrade php-soapUpgrade php-mysqlUpgrade php-gdUpgrade php-xmlrpcUpgrade php-mysqlndUpgrade php-tidyUpgrade php-dbaUpgrade php-pgsqlUpgrade php-processUpgrade php-snmpUpgrade php-mbstringUpgrade php-imapUpgrade php-pspell | Dec 1, 2016 | Jun 9, 2015 |
| Freebsd | — | Upgrade php56Upgrade php5Upgrade php55 | Dec 10, 2025 | May 22, 2015 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Jun 9, 2015 |
| Oracle Solaris | — | Upgrade web/php-56/extension/php-xdebug to version 2.3.2-0.175.3.22.0.2.0 on Solaris 11.3Upgrade web/php-56/extension/php-suhosin-extension to version 0.9.37.1-0.175.3.22.0.2.0 on Solaris 11.3Upgrade web/php-56 to version 5.6.30-0.175.3.22.0.2.0 on Solaris 11.3 | Jul 19, 2017 | Jun 9, 2015 |
| Oracle_linux | — | Upgrade php54-php-tidyUpgrade php-pgsqlUpgrade php-cliUpgrade php-mysqlndUpgrade php54-php-imapUpgrade php55-php-commonUpgrade php-mysqlUpgrade php-imapUpgrade php-intlUpgrade php54-php-xmlUpgrade php55-php-gdUpgrade php55-php-xmlUpgrade php54-php-dbaUpgrade php55-php-cliUpgrade php-odbcUpgrade php54-php-fpmUpgrade php-snmpUpgrade php-xmlUpgrade php55-php-processUpgrade php54-php-ldapUpgrade php54-php-bcmathUpgrade php-mbstringUpgrade php54-php-recodeUpgrade php55-php-enchantUpgrade php-tidyUpgrade php-ztsUpgrade php54-php-pgsqlUpgrade php55-php-fpmUpgrade php55-php-odbcUpgrade php55-php-pgsqlUpgrade php54-php-intlUpgrade php55-php-bcmathUpgrade php54-php-xmlrpcUpgrade php54-php-snmpUpgrade php54-php-develUpgrade php54-php-mbstringUpgrade php55-php-soapUpgrade php54-phpUpgrade php54-php-processUpgrade php54-php-odbcUpgrade php-commonUpgrade php-dbaUpgrade php-ldapUpgrade php54-php-commonUpgrade php-embeddedUpgrade php54-php-mysqlndUpgrade php55-php-opcacheUpgrade php54-php-cliUpgrade php54-php-soapUpgrade php54-php-gdUpgrade php55-php-xmlrpcUpgrade php-enchantUpgrade php55-phpUpgrade php54-php-pspellUpgrade php-gdUpgrade php-xmlrpcUpgrade php55-php-gmpUpgrade phpUpgrade php55-php-mbstringUpgrade php-processUpgrade php54-php-enchantUpgrade php55-php-ldapUpgrade php-fpmUpgrade php-develUpgrade php55-php-dbaUpgrade php54-php-pdoUpgrade php55-php-intlUpgrade php-pspellUpgrade php55-php-develUpgrade php55-php-pspellUpgrade php55-php-pdoUpgrade php-recodeUpgrade php55-php-snmpUpgrade php-pdoUpgrade php55-php-recodeUpgrade php-bcmathUpgrade php-soapUpgrade php55-php-mysqlnd | Oct 16, 2024 | Jun 9, 2015 |
| Php | — | Upgrade to PHP version 5.5.25Upgrade to PHP version 5.6.9Upgrade to PHP version 5.4.41 | Jun 17, 2015 | Jun 9, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 14, 2015 |
| Suse | — | Upgrade php53-wddxUpgrade php53-ldapUpgrade php53-calendarUpgrade php53-bz2Upgrade php5-zipUpgrade php5-fastcgiUpgrade php53-odbcUpgrade php53-domUpgrade php5-opensslUpgrade php53-tidyUpgrade php53-sqliteUpgrade php53-socketsUpgrade php5-sysvsemUpgrade php53-xmlreaderUpgrade php5-xmlreaderUpgrade php53-develUpgrade php5-socketsUpgrade php5-ftpUpgrade apache2-mod_php53Upgrade php5-xmlwriterUpgrade php53-sysvmsgUpgrade php53-mcryptUpgrade php53-sysvsemUpgrade php53-shmopUpgrade php53-posixUpgrade php5-ctypeUpgrade php53-ftpUpgrade php5-xmlrpcUpgrade php5-sysvshmUpgrade php5-domUpgrade php5-wddxUpgrade php53-mysqlUpgrade php53-pgsqlUpgrade php5-xslUpgrade php5-mbstringUpgrade php53-suhosinUpgrade php5-iconvUpgrade php5-gettextUpgrade php53-gettextUpgrade apache2-mod_php5Upgrade php53-jsonUpgrade php5-intlUpgrade php5-pearUpgrade php53-zipUpgrade php53-mbstringUpgrade php5-sysvmsgUpgrade php53-soapUpgrade php53-curlUpgrade php5-bcmathUpgrade php5-exifUpgrade php53-imapUpgrade php5-ldapUpgrade php53-ctypeUpgrade php5-gmpUpgrade php53-bcmathUpgrade php5-mysqlUpgrade php5-pgsqlUpgrade php53-readlineUpgrade php53-tokenizerUpgrade php5-shmopUpgrade php53-snmpUpgrade php5-calendarUpgrade php53-exifUpgrade php5-odbcUpgrade php53-intlUpgrade php5-pdoUpgrade php53-sysvshmUpgrade php53-xslUpgrade php5-pcntlUpgrade php5-sqliteUpgrade php53-pcntlUpgrade php5-dbaUpgrade php53-iconvUpgrade php5-suhosinUpgrade php53-dbaUpgrade php53-pspellUpgrade php5-tokenizerUpgrade php53-fastcgiUpgrade php53-fileinfoUpgrade php5-gdUpgrade php5-curlUpgrade php53-gdUpgrade php5-mcryptUpgrade php53-zlibUpgrade php5-soapUpgrade php53Upgrade php5-bz2Upgrade php5-pspellUpgrade php5-enchantUpgrade php5-snmpUpgrade php53-pearUpgrade php5-zlibUpgrade php53-opensslUpgrade php5-develUpgrade php53-pdoUpgrade php5-jsonUpgrade php53-gmpUpgrade php53-xmlrpcUpgrade php53-xmlwriterUpgrade php5-fileinfoUpgrade php5-fpmUpgrade php5 | Dec 18, 2015 | Jun 9, 2015 |
| Ubuntu | — | Upgrade php5-fpmUpgrade php5-cliUpgrade php5-cgiUpgrade libapache2-mod-php5 | Nov 8, 2024 | Jun 9, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub