SB2016011917 - Multiple vulnerabilities in PHP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016011917

SB2016011917 - Multiple vulnerabilities in PHP

Published: January 19, 2016 Updated: August 9, 2020

Security Bulletin ID SB2016011917
Severity
Medium
Patch available
NO
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Path traversal (CVE-ID: CVE-2015-6833)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to write to arbitrary files via a . (dot dot) in a ZIP archive entry that is mishandled during an extractTo call.


2) Use-after-free (CVE-ID: CVE-2015-6832)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing crafted serialized data that triggers misuse of an array field. <a href="http://cwe.mitre.org/data/definitions/416. A remote attackers can execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


3) Input validation error (CVE-ID: CVE-2015-6831)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving (1) ArrayObject, (2) SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled during unserialization. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References