ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Apache | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Aug 28, 2015 | Jun 9, 2015 |
| Apple Osx Apachemodphp | — | Apply OS X security update 2015-006Upgrade macOS to the latest version | Mar 29, 2016 | Jun 9, 2015 |
| Centos_linux | — | Upgrade php-odbcUpgrade php-ldapUpgrade php-intlUpgrade php-tidyUpgrade php-imapUpgrade php-soapUpgrade php-embeddedUpgrade php-dbaUpgrade php-pgsqlUpgrade phpUpgrade php-bcmathUpgrade php-commonUpgrade php-develUpgrade php-pspellUpgrade php-mbstringUpgrade php-processUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-mysqlUpgrade php-recodeUpgrade php-gdUpgrade php-snmpUpgrade php-ztsUpgrade php-pdoUpgrade php-mysqlndUpgrade php-cliUpgrade php-xmlUpgrade php-enchant | Dec 1, 2016 | Jun 9, 2015 |
| Freebsd | — | Upgrade php55Upgrade php5Upgrade php56 | Dec 10, 2025 | Apr 25, 2015 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Jun 9, 2015 |
| Hpux | — | Update hpuxws22APACHE.PHP2 to the latest versionUpdate hpuxws22APACHE.APACHE to the latest versionUpdate hpuxws22APACHE.AUTH_LDAP to the latest versionUpdate hpuxws22APCH32.AUTH_LDAP2 to the latest versionUpdate hpuxws22APACHE.WEBPROXY2 to the latest versionUpdate hpuxws22TOMCAT.TOMCAT to the latest versionUpdate hpuxws22APCH32.APACHE to the latest versionUpdate hpuxws22APCH32.AUTH_LDAP to the latest versionUpdate hpuxws22APCH32.WEBPROXY2 to the latest versionUpdate hpuxws22APACHE.PHP to the latest versionUpdate hpuxws22APCH32.APACHE2 to the latest versionUpdate hpuxws22APACHE.WEBPROXY to the latest versionUpdate hpuxws22APACHE.MOD_PERL2 to the latest versionUpdate hpuxws22APCH32.WEBPROXY to the latest versionUpdate hpuxws22APACHE.AUTH_LDAP2 to the latest versionUpdate hpuxws22APACHE.MOD_JK to the latest versionUpdate hpuxws22APACHE.MOD_PERL to the latest versionUpdate hpuxws22APCH32.MOD_PERL to the latest versionUpdate hpuxws22APCH32.PHP to the latest versionUpdate hpuxws22APCH32.MOD_JK2 to the latest versionUpdate hpuxws22APACHE.MOD_JK2 to the latest versionUpdate hpuxws22APACHE.APACHE2 to the latest versionUpdate hpuxws22APCH32.MOD_JK to the latest versionUpdate hpuxws22APCH32.PHP2 to the latest versionUpdate hpuxws22APCH32.MOD_PERL2 to the latest version | Aug 11, 2017 | Jun 9, 2015 |
| Oracle Solaris | — | Upgrade web/php-53/extension/php-xdebug to version 2.2.0-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-idn to version 0.2.0-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-apc to version 3.0.19-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/server/apache-22/module/apache-php52 to version 5.2.17-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52 to version 5.2.17-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-xdebug to version 2.0.5-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-pear to version 5.3.29-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53 to version 5.3.29-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-zendopcache to version 7.0.2-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-mysql to version 5.3.29-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-tcpwrap to version 1.1.3-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-memcache to version 2.2.5-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-tcpwrap to version 1.1.3-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-memcache to version 3.0.6-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-pear to version 5.2.17-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-apc to version 3.1.9-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/server/apache-22/module/apache-php53 to version 5.3.29-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-suhosin to version 0.9.29-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-mysql to version 5.2.17-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-suhosin to version 0.9.33-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-idn to version 0.2.0-0.175.2.12.0.4.0 on Solaris 11.2 | May 29, 2017 | Jun 9, 2015 |
| Oracle_linux | — | Upgrade php-ztsUpgrade php54-php-intlUpgrade php-fpmUpgrade php54-php-soapUpgrade php54-php-fpmUpgrade php-embeddedUpgrade php55-php-pdoUpgrade php-gdUpgrade php55-php-pspellUpgrade php55-php-dbaUpgrade php54-php-commonUpgrade php55-php-gmpUpgrade php55-php-intlUpgrade php54-scldevelUpgrade php-pdoUpgrade php54-php-gdUpgrade php-develUpgrade php55-php-cliUpgrade php54-php-pspellUpgrade php54-php-pecl-zendopcacheUpgrade php54-php-mysqlndUpgrade php55-php-processUpgrade php-bcmathUpgrade php54-php-enchantUpgrade php-enchantUpgrade php-pspellUpgrade php54-php-mbstringUpgrade php54Upgrade php55-php-mbstringUpgrade php55-php-ldapUpgrade php55-php-gdUpgrade php-pgsqlUpgrade php-ldapUpgrade php55-php-soapUpgrade php-soapUpgrade php54-php-cliUpgrade php54-php-recodeUpgrade php55-php-commonUpgrade php55-php-develUpgrade php54-php-dbaUpgrade php54-php-pdoUpgrade php-odbcUpgrade php55-php-fpmUpgrade php-xmlrpcUpgrade php54-php-ldapUpgrade php54-php-imapUpgrade php55-php-enchantUpgrade php-cliUpgrade php-dbaUpgrade php54-php-snmpUpgrade php54-php-develUpgrade phpUpgrade php-mysqlUpgrade php55-php-odbcUpgrade php55-php-recodeUpgrade php55-php-xmlrpcUpgrade php55-php-pgsqlUpgrade php54-php-pgsqlUpgrade php54-php-bcmathUpgrade php-mysqlndUpgrade php55-php-mysqlndUpgrade php55-php-xmlUpgrade php54-php-tidyUpgrade php-snmpUpgrade php54-runtimeUpgrade php-processUpgrade php-xmlUpgrade php55-phpUpgrade php54-php-processUpgrade php55-php-opcacheUpgrade php54-php-xmlUpgrade php54-php-odbcUpgrade php-mbstringUpgrade php-recodeUpgrade php-intlUpgrade php-commonUpgrade php54-phpUpgrade php-tidyUpgrade php55-php-bcmathUpgrade php54-php-xmlrpcUpgrade php55-php-snmpUpgrade php-imap | Oct 16, 2024 | Jun 9, 2015 |
| Php | — | Upgrade to PHP version 5.4.40Upgrade to PHP version 5.6.8Upgrade to PHP version 5.5.24 | Jun 25, 2015 | Jun 9, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2015 |
| Suse | — | Upgrade php53-bcmathUpgrade php5-opensslUpgrade php53-iconvUpgrade php5-calendarUpgrade php5Upgrade php53-pcntlUpgrade php53-mbstringUpgrade php53-posixUpgrade php5-enchantUpgrade php53-imapUpgrade php53-calendarUpgrade php53Upgrade php5-jsonUpgrade php53-fastcgiUpgrade php53-ldapUpgrade php5-mysqlUpgrade php5-fastcgiUpgrade php53-zlibUpgrade php5-sysvsemUpgrade php53-xmlreaderUpgrade php53-tidyUpgrade php5-bz2Upgrade php53-zipUpgrade php53-gdUpgrade php53-ctypeUpgrade php5-ftpUpgrade php53-pearUpgrade php53-curlUpgrade php53-mcryptUpgrade php5-shmopUpgrade php53-gmpUpgrade php53-shmopUpgrade php5-pcntlUpgrade php5-mcryptUpgrade php5-xmlwriterUpgrade php5-pdoUpgrade php53-sysvshmUpgrade php53-bz2Upgrade php5-fpmUpgrade php53-wddxUpgrade php53-sysvsemUpgrade php5-ctypeUpgrade php5-fileinfoUpgrade php53-opensslUpgrade php53-mysqlUpgrade php53-jsonUpgrade php53-tokenizerUpgrade php53-xmlrpcUpgrade php53-ftpUpgrade php5-socketsUpgrade php5-exifUpgrade php5-intlUpgrade apache2-mod_php53Upgrade php5-sysvmsgUpgrade php5-zlibUpgrade php5-iconvUpgrade php53-sysvmsgUpgrade php53-intlUpgrade php53-domUpgrade php5-ldapUpgrade php5-sysvshmUpgrade php53-soapUpgrade php53-fileinfoUpgrade php53-pgsqlUpgrade php5-tokenizerUpgrade php5-zipUpgrade php53-develUpgrade php5-gettextUpgrade php5-suhosinUpgrade php5-gdUpgrade php5-mbstringUpgrade php5-pearUpgrade php5-pspellUpgrade php5-domUpgrade php5-wddxUpgrade php53-pspellUpgrade php53-xmlwriterUpgrade php53-exifUpgrade php5-xslUpgrade apache2-mod_php5Upgrade php53-xslUpgrade php5-pgsqlUpgrade php5-xmlrpcUpgrade php5-develUpgrade php53-suhosinUpgrade php5-xmlreaderUpgrade php53-snmpUpgrade php53-readlineUpgrade php53-gettextUpgrade php5-sqliteUpgrade php53-dbaUpgrade php5-gmpUpgrade php5-bcmathUpgrade php5-soapUpgrade php53-sqliteUpgrade php53-socketsUpgrade php5-odbcUpgrade php53-pdoUpgrade php53-odbcUpgrade php5-curlUpgrade php5-dbaUpgrade php5-snmp | Dec 18, 2015 | May 13, 2015 |
| Ubuntu | — | Upgrade php5-cliUpgrade php5-cgiUpgrade php5-fpmUpgrade libapache2-mod-php5 | Nov 8, 2024 | Jun 9, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub