PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade php-fpmUpgrade php-processUpgrade php-xmlrpcUpgrade php-pspellUpgrade php-enchantUpgrade php-cliUpgrade php-mbstringUpgrade php-mysqlUpgrade php-pdoUpgrade php-recodeUpgrade php-snmpUpgrade php-ztsUpgrade php-xmlUpgrade php-develUpgrade php-gdUpgrade php-imapUpgrade php-pgsqlUpgrade php-mysqlndUpgrade php-bcmathUpgrade php-tidyUpgrade php-ldapUpgrade php-soapUpgrade php-intlUpgrade php-dbaUpgrade php-odbcUpgrade php-commonUpgrade phpUpgrade php-embedded | Dec 1, 2016 | May 16, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Aug 6, 2015 |
| Oracle_linux | — | Upgrade php55-php-mbstringUpgrade php-dbaUpgrade php-imapUpgrade php54-php-cliUpgrade php-xmlrpcUpgrade phpUpgrade php54-php-recodeUpgrade php-pdoUpgrade php55-phpUpgrade php-processUpgrade php55-php-xmlrpcUpgrade php55-php-pspellUpgrade php54Upgrade php54-php-enchantUpgrade php55-php-snmpUpgrade php55-php-pdoUpgrade php-develUpgrade php55-php-mysqlndUpgrade php54-php-soapUpgrade php54-php-commonUpgrade php55-php-dbaUpgrade php54-php-pecl-zendopcacheUpgrade php54-php-gdUpgrade php-pspellUpgrade php-recodeUpgrade php-enchantUpgrade php-intlUpgrade php55-php-develUpgrade php-gdUpgrade php-fpmUpgrade php-bcmathUpgrade php-mysqlndUpgrade php-tidyUpgrade php55-php-gmpUpgrade php-soapUpgrade php55-php-opcacheUpgrade php54-php-mysqlndUpgrade php54-php-processUpgrade php54-runtimeUpgrade php-ldapUpgrade php-embeddedUpgrade php54-php-pdoUpgrade php55-php-processUpgrade php-commonUpgrade php55-php-recodeUpgrade php54-php-imapUpgrade php54-phpUpgrade php54-php-bcmathUpgrade php54-php-xmlrpcUpgrade php55-php-fpmUpgrade php54-php-fpmUpgrade php-ztsUpgrade php-mbstringUpgrade php55-php-intlUpgrade php-pgsqlUpgrade php54-php-develUpgrade php54-php-xmlUpgrade php55-php-ldapUpgrade php54-php-pspellUpgrade php55-php-commonUpgrade php55-php-soapUpgrade php-snmpUpgrade php54-php-intlUpgrade php-odbcUpgrade php-xmlUpgrade php-mysqlUpgrade php54-php-dbaUpgrade php54-php-mbstringUpgrade php54-php-pgsqlUpgrade php54-php-tidyUpgrade php55-php-gdUpgrade php55-php-bcmathUpgrade php55-php-xmlUpgrade php55-php-pgsqlUpgrade php54-scldevelUpgrade php54-php-odbcUpgrade php54-php-snmpUpgrade php55-php-odbcUpgrade php-cliUpgrade php54-php-ldapUpgrade php55-php-cliUpgrade php55-php-enchant | Oct 16, 2024 | May 16, 2016 |
| Php | — | Upgrade to PHP version 5.5.24Upgrade to PHP version 5.4.40Upgrade to PHP version 5.6.8 | Jun 3, 2016 | May 16, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2015 |
| Suse | — | Upgrade php53-fileinfoUpgrade php5-exifUpgrade php5-xmlreaderUpgrade php5-iconvUpgrade php5-pspellUpgrade php5-shmopUpgrade php53-gdUpgrade php5-sysvsemUpgrade php53-soapUpgrade php53-tidyUpgrade php53-sysvsemUpgrade php5-curlUpgrade php5-xslUpgrade php53-zlibUpgrade php5-sysvmsgUpgrade php53Upgrade php5-gdUpgrade php5-fastcgiUpgrade php5-snmpUpgrade php53-calendarUpgrade php53-pcntlUpgrade php53-zipUpgrade php53-ctypeUpgrade php53-snmpUpgrade php5-mbstringUpgrade php5-ctypeUpgrade php5-sqliteUpgrade php53-sysvshmUpgrade php53-sqliteUpgrade php5-mcryptUpgrade php5-bcmathUpgrade php5-ldapUpgrade php5-fpmUpgrade php53-shmopUpgrade php53-odbcUpgrade php53-sysvmsgUpgrade php5-pearUpgrade php5-opensslUpgrade php53-mbstringUpgrade php5-bz2Upgrade php53-xmlwriterUpgrade php5-socketsUpgrade php53-pdoUpgrade php53-mcryptUpgrade apache2-mod_php53Upgrade php5-suhosinUpgrade php5-fileinfoUpgrade php5-domUpgrade php53-iconvUpgrade php5-xmlrpcUpgrade php53-readlineUpgrade php53-xmlreaderUpgrade php53-posixUpgrade php53-intlUpgrade php5-sysvshmUpgrade php5-intlUpgrade php5-develUpgrade php5-wddxUpgrade php53-bz2Upgrade php53-dbaUpgrade php53-jsonUpgrade php53-fastcgiUpgrade php53-bcmathUpgrade php5-jsonUpgrade php5-xmlwriterUpgrade php53-xslUpgrade php5-gmpUpgrade php53-suhosinUpgrade php5-soapUpgrade php5-pgsqlUpgrade php5-gettextUpgrade php53-domUpgrade php5-calendarUpgrade php53-pgsqlUpgrade php53-ldapUpgrade php53-xmlrpcUpgrade php5-pdoUpgrade php53-ftpUpgrade php53-wddxUpgrade php53-develUpgrade php5-mysqlUpgrade php5-enchantUpgrade php5-odbcUpgrade php53-pspellUpgrade php53-tokenizerUpgrade php53-curlUpgrade php5-ftpUpgrade php53-socketsUpgrade php53-mysqlUpgrade php5-dbaUpgrade php53-pearUpgrade php5-zipUpgrade php53-opensslUpgrade php53-gmpUpgrade php5-pcntlUpgrade apache2-mod_php5Upgrade php5-tokenizerUpgrade php53-gettextUpgrade php53-imapUpgrade php5-zlibUpgrade php5Upgrade php53-exif | Dec 18, 2015 | Jul 17, 2015 |
| Ubuntu | — | Upgrade php5-fpmUpgrade php5-cliUpgrade php5-cgiUpgrade libapache2-mod-php5 | Nov 8, 2024 | May 16, 2016 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub