Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Apache | — | Apply OS X security update 2015-006Upgrade macOS to the latest version | Aug 28, 2015 | Jun 9, 2015 |
| Apple Osx Apachemodphp | — | Apply OS X security update 2015-006Upgrade macOS to the latest version | Mar 29, 2016 | Jun 9, 2015 |
| Centos_linux | — | Upgrade php-ldapUpgrade php-pdoUpgrade php-embeddedUpgrade php-cliUpgrade php-enchantUpgrade php-ztsUpgrade php-xmlUpgrade php-fpmUpgrade php-recodeUpgrade php-develUpgrade php-commonUpgrade php-odbcUpgrade php-bcmathUpgrade phpUpgrade php-mysqlUpgrade php-pgsqlUpgrade php-soapUpgrade php-snmpUpgrade php-intlUpgrade php-mysqlndUpgrade php-mbstringUpgrade php-gdUpgrade php-dbaUpgrade php-imapUpgrade php-processUpgrade php-pspellUpgrade php-xmlrpcUpgrade php-tidy | Dec 1, 2016 | Jun 9, 2015 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Jun 9, 2015 |
| Oracle Solaris | — | Upgrade web/php-53/extension/php-zendopcache to version 7.0.2-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-xdebug to version 2.2.0-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/server/apache-22/module/apache-php53 to version 5.3.29-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52 to version 5.2.17-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-pear to version 5.3.29-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-mysql to version 5.2.17-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-tcpwrap to version 1.1.3-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/server/apache-22/module/apache-php52 to version 5.2.17-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-idn to version 0.2.0-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-tcpwrap to version 1.1.3-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-apc to version 3.0.19-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-suhosin to version 0.9.29-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-pear to version 5.2.17-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-suhosin to version 0.9.33-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-apc to version 3.1.9-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-idn to version 0.2.0-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-memcache to version 2.2.5-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53 to version 5.3.29-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-memcache to version 3.0.6-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-52/extension/php-xdebug to version 2.0.5-0.175.2.12.0.4.0 on Solaris 11.2Upgrade web/php-53/extension/php-mysql to version 5.3.29-0.175.2.12.0.4.0 on Solaris 11.2 | May 29, 2017 | Jun 9, 2015 |
| Oracle_linux | — | Upgrade php-soapUpgrade php54-php-enchantUpgrade php-enchantUpgrade php54-php-intlUpgrade php-ldapUpgrade php-bcmathUpgrade php54-php-pspellUpgrade php54-php-pecl-zendopcacheUpgrade php-gdUpgrade php55-php-commonUpgrade php54-php-mysqlndUpgrade php-develUpgrade phpUpgrade php54-php-gdUpgrade php-dbaUpgrade php55-php-recodeUpgrade php55-php-soapUpgrade php54-php-soapUpgrade php-pspellUpgrade php-recodeUpgrade php54Upgrade php-fpmUpgrade php54-php-mbstringUpgrade php55-php-dbaUpgrade php-ztsUpgrade php-embeddedUpgrade php55-php-opcacheUpgrade php55-php-mbstringUpgrade php55-php-pdoUpgrade php55-php-pspellUpgrade php55-php-snmpUpgrade php55-php-intlUpgrade php55-php-gmpUpgrade php55-php-processUpgrade php54-php-cliUpgrade php55-php-gdUpgrade php54-php-fpmUpgrade php-pdoUpgrade php-imapUpgrade php54-php-odbcUpgrade php55-php-cliUpgrade php-intlUpgrade php55-php-xmlrpcUpgrade php54-php-bcmathUpgrade php54-php-recodeUpgrade php55-php-fpmUpgrade php54-php-imapUpgrade php55-php-develUpgrade php55-php-odbcUpgrade php55-php-bcmathUpgrade php55-php-ldapUpgrade php54-php-dbaUpgrade php-tidyUpgrade php54-php-processUpgrade php-mbstringUpgrade php-pgsqlUpgrade php-odbcUpgrade php54-php-tidyUpgrade php55-php-mysqlndUpgrade php55-php-enchantUpgrade php54-php-ldapUpgrade php-processUpgrade php54-php-xmlrpcUpgrade php54-php-commonUpgrade php-xmlUpgrade php-mysqlndUpgrade php55-phpUpgrade php-cliUpgrade php54-phpUpgrade php54-php-xmlUpgrade php55-php-xmlUpgrade php-commonUpgrade php54-runtimeUpgrade php54-php-pgsqlUpgrade php-snmpUpgrade php54-php-develUpgrade php-mysqlUpgrade php-xmlrpcUpgrade php55-php-pgsqlUpgrade php54-php-snmpUpgrade php54-php-pdoUpgrade php54-scldevel | Oct 16, 2024 | Jun 9, 2015 |
| Php | — | Upgrade to PHP version 5.4.40Upgrade to PHP version 5.6.8Upgrade to PHP version 5.5.24 | Jun 17, 2015 | Jun 9, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2015 |
| Suse | — | Upgrade php53-calendarUpgrade php53-mysqlUpgrade php5-jsonUpgrade php5-pdoUpgrade php5-sysvshmUpgrade php53-ftpUpgrade php53-fastcgiUpgrade php5-calendarUpgrade php53-bcmathUpgrade php5-intlUpgrade php5-fpmUpgrade php53-gmpUpgrade php5-develUpgrade php5-pspellUpgrade php53-mcryptUpgrade php53-domUpgrade php53-shmopUpgrade php53-dbaUpgrade php5-sysvsemUpgrade php5-zipUpgrade php53-tidyUpgrade php5-wddxUpgrade php53-ldapUpgrade php5-pcntlUpgrade php53-jsonUpgrade php5-suhosinUpgrade php5-fastcgiUpgrade php53-pearUpgrade php5-gettextUpgrade php5-fileinfoUpgrade php5-gdUpgrade php53-curlUpgrade php53-gettextUpgrade php5-enchantUpgrade php53-wddxUpgrade php53-bz2Upgrade php53-pgsqlUpgrade php5-bcmathUpgrade php5Upgrade apache2-mod_php5Upgrade php5-mysqlUpgrade php5-xmlwriterUpgrade php5-dbaUpgrade php53-develUpgrade php53-suhosinUpgrade php5-bz2Upgrade php5-pearUpgrade php53-sysvmsgUpgrade php53-pdoUpgrade php53-xslUpgrade php53-sqliteUpgrade php53-odbcUpgrade php5-xslUpgrade php5-opensslUpgrade php53-xmlrpcUpgrade php53-iconvUpgrade php5-exifUpgrade php53-gdUpgrade php53-posixUpgrade php5-zlibUpgrade php5-tokenizerUpgrade php53-xmlreaderUpgrade php53-intlUpgrade php5-ctypeUpgrade php53-ctypeUpgrade php53-sysvshmUpgrade php53-socketsUpgrade php5-xmlreaderUpgrade php53-zlibUpgrade php5-soapUpgrade php5-mbstringUpgrade php5-odbcUpgrade php53-pcntlUpgrade php53-zipUpgrade php53-exifUpgrade php53Upgrade php5-curlUpgrade php53-xmlwriterUpgrade php53-soapUpgrade php53-sysvsemUpgrade php53-pspellUpgrade php53-tokenizerUpgrade php5-xmlrpcUpgrade php53-opensslUpgrade php5-shmopUpgrade php5-pgsqlUpgrade php53-imapUpgrade php5-ldapUpgrade php5-mcryptUpgrade php5-sysvmsgUpgrade php5-iconvUpgrade php5-snmpUpgrade php53-fileinfoUpgrade php5-ftpUpgrade php5-gmpUpgrade php53-mbstringUpgrade php5-socketsUpgrade php5-domUpgrade php5-sqliteUpgrade php53-readlineUpgrade php53-snmpUpgrade apache2-mod_php53 | Dec 18, 2015 | May 13, 2015 |
| Ubuntu | — | Upgrade php5-cliUpgrade php5-fpmUpgrade php5-cgiUpgrade libapache2-mod-php5 | Nov 8, 2024 | Jun 9, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub