The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Apache | — | Apply OS X security update 2015-006Upgrade macOS to the latest version | Aug 28, 2015 | Jun 9, 2015 |
| Apple Osx Apachemodphp | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Mar 29, 2016 | Jun 9, 2015 |
| Centos_linux | — | Upgrade php-processUpgrade php-mysqlUpgrade php-embeddedUpgrade php-dbaUpgrade php-recodeUpgrade php-enchantUpgrade php-mbstringUpgrade php-gdUpgrade php-pspellUpgrade php-mysqlndUpgrade php-xmlrpcUpgrade php-soapUpgrade php-tidyUpgrade php-fpmUpgrade php-ldapUpgrade php-bcmathUpgrade php-pgsqlUpgrade php-develUpgrade php-snmpUpgrade php-intlUpgrade php-xmlUpgrade phpUpgrade php-ztsUpgrade php-pdoUpgrade php-odbcUpgrade php-imapUpgrade php-commonUpgrade php-cli | Dec 1, 2016 | Jun 9, 2015 |
| Oracle_linux | — | Upgrade php54-runtimeUpgrade php-gdUpgrade php55-php-snmpUpgrade php54-php-ldapUpgrade php54-php-pecl-zendopcacheUpgrade php-develUpgrade php54-php-intlUpgrade php55-php-xmlrpcUpgrade php-processUpgrade php54-php-fpmUpgrade php54-php-snmpUpgrade php55-php-ldapUpgrade php-fpmUpgrade php55-php-processUpgrade php54-php-pspellUpgrade php55-php-odbcUpgrade php-pdoUpgrade php54-php-tidyUpgrade php54-php-cliUpgrade php-xmlUpgrade php55-php-cliUpgrade php54Upgrade php55-php-fpmUpgrade php-commonUpgrade php54-php-pgsqlUpgrade php-bcmathUpgrade php55-php-commonUpgrade php54-php-develUpgrade php-mbstringUpgrade php54-php-recodeUpgrade php55-php-soapUpgrade php54-php-commonUpgrade php54-scldevelUpgrade php-ztsUpgrade php55-php-dbaUpgrade php-mysqlUpgrade php55-php-bcmathUpgrade php55-php-enchantUpgrade php55-php-pdoUpgrade php54-php-mbstringUpgrade php-xmlrpcUpgrade php55-php-develUpgrade php54-php-dbaUpgrade php-dbaUpgrade php54-php-bcmathUpgrade php-recodeUpgrade phpUpgrade php55-php-mbstringUpgrade php54-php-odbcUpgrade php54-php-processUpgrade php-pgsqlUpgrade php54-phpUpgrade php-soapUpgrade php55-php-gdUpgrade php54-php-pdoUpgrade php55-php-gmpUpgrade php54-php-mysqlndUpgrade php-snmpUpgrade php55-php-pgsqlUpgrade php-intlUpgrade php-imapUpgrade php55-phpUpgrade php54-php-imapUpgrade php-cliUpgrade php55-php-recodeUpgrade php55-php-xmlUpgrade php55-php-mysqlndUpgrade php-odbcUpgrade php54-php-enchantUpgrade php54-php-soapUpgrade php55-php-pspellUpgrade php-embeddedUpgrade php-ldapUpgrade php-mysqlndUpgrade php-tidyUpgrade php55-php-opcacheUpgrade php54-php-xmlUpgrade php-pspellUpgrade php55-php-intlUpgrade php54-php-xmlrpcUpgrade php-enchantUpgrade php54-php-gd | Oct 16, 2024 | Jun 9, 2015 |
| Php | — | Upgrade to PHP version 5.4.40Upgrade to PHP version 5.5.24Upgrade to PHP version 5.6.8 | Jun 17, 2015 | Jun 9, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 18, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub