Resource exhaustion in PHP - CVE-2015-9253

Vulnerability identifier: #VU10880

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-9253

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the php-fpm master process due to improper processing of crafted PHP scripts. A remote attacker can send a specially crafted PHP script, trigger the php-fpm master process to restart a child process and cause the php-fpm master process the php-fpm master process to consume all available CPU resources and excessive amounts of disk space that results in denial of service.

PHP
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Web Scripting
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP
php5 (Ubuntu package)
php7.0 (Ubuntu package)
php7 (Alpine package)
php7.2 (Ubuntu package)
php7.3 (Ubuntu package)
php72-posix-debuginfo
php72-sodium
php72-pspell
php72-pspell-debuginfo
php72-readline
php72-readline-debuginfo
php72-shmop
php72-shmop-debuginfo
php72-snmp
php72-snmp-debuginfo
php72-soap
php72-soap-debuginfo
php72-sockets
php72-sockets-debuginfo
php72-odbc-debuginfo
php72-posix
php72-phar-debuginfo
php72-phar
php72-pgsql-debuginfo
php72-pgsql
php72-pdo-debuginfo
php72-pdo
php72-pcntl-debuginfo
php72-pcntl
php72-openssl-debuginfo
php72-openssl
php72-opcache-debuginfo
php72-opcache
php72-zip-debuginfo
php72-wddx-debuginfo
php72-pear-Archive_Tar
php72-pear
php72-zlib-debuginfo
php72-zlib
php72-zip
php72-xsl-debuginfo
php72-xsl
php72-xmlwriter-debuginfo
php72-xmlwriter
php72-xmlrpc-debuginfo
php72-xmlrpc
php72-xmlreader-debuginfo
php72-xmlreader
php72-sodium-debuginfo
php72-wddx
php72-tokenizer-debuginfo
php72-tokenizer
php72-tidy-debuginfo
php72-tidy
php72-sysvshm-debuginfo
php72-sysvshm
php72-sysvsem-debuginfo
php72-sysvsem
php72-sysvmsg-debuginfo
php72-sysvmsg
php72-sqlite-debuginfo
php72-sqlite
php72-calendar-debuginfo
php72-fastcgi
php72-exif-debuginfo
php72-exif
php72-enchant-debuginfo
php72-enchant
php72-dom-debuginfo
php72-dom
php72-dba-debuginfo
php72-dba
php72-curl-debuginfo
php72-curl
php72-ctype-debuginfo
php72-ctype
php72-mysql-debuginfo
php72-calendar
php72-bz2-debuginfo
php72-bz2
php72-bcmath-debuginfo
php72-bcmath
php72
apache2-mod_php72-debuginfo
apache2-mod_php72
php72-devel
php72-debugsource
php72-odbc
php72-debuginfo
php72-fileinfo
php72-fastcgi-debuginfo
php72-mysql
php72-mbstring-debuginfo
php72-mbstring
php72-ldap-debuginfo
php72-ldap
php72-json-debuginfo
php72-json
php72-intl-debuginfo
php72-intl
php72-imap-debuginfo
php72-imap
php72-iconv-debuginfo
php72-gmp-debuginfo
php72-iconv
php72-fileinfo-debuginfo
php72-fpm
php72-fpm-debuginfo
php72-ftp
php72-ftp-debuginfo
php72-gd
php72-gd-debuginfo
php72-gettext
php72-gettext-debuginfo
php72-gmp
php7-posix
php7-posix-debuginfo
php7-readline
php7-readline-debuginfo
php7-shmop
php7-shmop-debuginfo
php7-snmp
php7-snmp-debuginfo
php7-soap
php7-soap-debuginfo
php7-sockets
php7-sockets-debuginfo
php7-sodium
php7-sodium-debuginfo
php7-phar-debuginfo
php7-phar
php7-pgsql-debuginfo
php7-pgsql
php7-pdo-debuginfo
php7-pdo
php7-pcntl-debuginfo
php7-pcntl
php7-openssl-debuginfo
php7-openssl
php7-opcache-debuginfo
php7-opcache
php7-pear-Archive_Tar
php7-odbc-debuginfo
php7-wddx-debuginfo
php7-pear
php7-zlib-debuginfo
php7-zlib
php7-zip-debuginfo
php7-zip
php7-xsl-debuginfo
php7-xsl
php7-xmlwriter-debuginfo
php7-xmlwriter
php7-xmlrpc-debuginfo
php7-xmlrpc
php7-xmlreader-debuginfo
php7-xmlreader
php7-sqlite
php7-wddx
php7-tokenizer-debuginfo
php7-tokenizer
php7-tidy-debuginfo
php7-tidy
php7-sysvshm-debuginfo
php7-sysvshm
php7-sysvsem-debuginfo
php7-sysvsem
php7-sysvmsg-debuginfo
php7-sysvmsg
php7-sqlite-debuginfo
php7-curl-debuginfo
php7-fastcgi
php7-exif-debuginfo
php7-exif
php7-enchant-debuginfo
php7-enchant
php7-dom-debuginfo
php7-dom
php7-devel
php7-debugsource
php7-debuginfo
php7-dba-debuginfo
php7-dba
php7-mysql-debuginfo
php7-curl
php7-ctype-debuginfo
php7-ctype
php7-calendar-debuginfo
php7-calendar
php7-bz2-debuginfo
php7-bz2
php7-bcmath-debuginfo
php7-bcmath
php7
apache2-mod_php7-debuginfo
apache2-mod_php7
php7-fileinfo
php7-odbc
php7-mysql
php7-mbstring-debuginfo
php7-mbstring
php7-ldap-debuginfo
php7-ldap
php7-json-debuginfo
php7-json
php7-intl-debuginfo
php7-intl
php7-iconv-debuginfo
php7-iconv
php7-gmp-debuginfo
php7-gmp
php7-gettext-debuginfo
php7-gettext
php7-gd-debuginfo
php7-gd
php7-ftp-debuginfo
php7-ftp
php7-fpm-debuginfo
php7-fpm
php7-fileinfo-debuginfo
php7-fastcgi-debuginfo

Update to version 7.2.3.

php5 (Ubuntu package) - update to 5.5.9+dfsg-1ubuntu4.26
php7.0 (Ubuntu package) - update to 7.0.32-0ubuntu0.16.04.1
php7 (Alpine package) - update to 7.2.8-r0
php7.2 (Ubuntu package) - addressed in versions 7.2.10-0ubuntu0.18.04.1, 7.2.24-0ubuntu0.18.04.3
php72-posix-debuginfo - update to 7.2.5-1.75.1
php72-sodium - update to 7.2.5-1.75.1
php72-pspell - update to 7.2.5-1.75.1
php72-pspell-debuginfo - update to 7.2.5-1.75.1
php72-readline - update to 7.2.5-1.75.1
php72-readline-debuginfo - update to 7.2.5-1.75.1
php72-shmop - update to 7.2.5-1.75.1
php72-shmop-debuginfo - update to 7.2.5-1.75.1
php72-snmp - update to 7.2.5-1.75.1
php72-snmp-debuginfo - update to 7.2.5-1.75.1
php72-soap - update to 7.2.5-1.75.1
php72-soap-debuginfo - update to 7.2.5-1.75.1
php72-sockets - update to 7.2.5-1.75.1
php72-sockets-debuginfo - update to 7.2.5-1.75.1
php72-odbc-debuginfo - update to 7.2.5-1.75.1
php72-posix - update to 7.2.5-1.75.1
php72-phar-debuginfo - update to 7.2.5-1.75.1
php72-phar - update to 7.2.5-1.75.1
php72-pgsql-debuginfo - update to 7.2.5-1.75.1
php72-pgsql - update to 7.2.5-1.75.1
php72-pdo-debuginfo - update to 7.2.5-1.75.1
php72-pdo - update to 7.2.5-1.75.1
php72-pcntl-debuginfo - update to 7.2.5-1.75.1
php72-pcntl - update to 7.2.5-1.75.1
php72-openssl-debuginfo - update to 7.2.5-1.75.1
php72-openssl - update to 7.2.5-1.75.1
php72-opcache-debuginfo - update to 7.2.5-1.75.1
php72-opcache - update to 7.2.5-1.75.1
php72-zip-debuginfo - update to 7.2.5-1.75.1
php72-wddx-debuginfo - update to 7.2.5-1.75.1
php72-pear-Archive_Tar - update to 7.2.5-1.75.1
php72-pear - update to 7.2.5-1.75.1
php72-zlib-debuginfo - update to 7.2.5-1.75.1
php72-zlib - update to 7.2.5-1.75.1
php72-zip - update to 7.2.5-1.75.1
php72-xsl-debuginfo - update to 7.2.5-1.75.1
php72-xsl - update to 7.2.5-1.75.1
php72-xmlwriter-debuginfo - update to 7.2.5-1.75.1
php72-xmlwriter - update to 7.2.5-1.75.1
php72-xmlrpc-debuginfo - update to 7.2.5-1.75.1
php72-xmlrpc - update to 7.2.5-1.75.1
php72-xmlreader-debuginfo - update to 7.2.5-1.75.1
php72-xmlreader - update to 7.2.5-1.75.1
php72-sodium-debuginfo - update to 7.2.5-1.75.1
php72-wddx - update to 7.2.5-1.75.1
php72-tokenizer-debuginfo - update to 7.2.5-1.75.1
php72-tokenizer - update to 7.2.5-1.75.1
php72-tidy-debuginfo - update to 7.2.5-1.75.1
php72-tidy - update to 7.2.5-1.75.1
php72-sysvshm-debuginfo - update to 7.2.5-1.75.1
php72-sysvshm - update to 7.2.5-1.75.1
php72-sysvsem-debuginfo - update to 7.2.5-1.75.1
php72-sysvsem - update to 7.2.5-1.75.1
php72-sysvmsg-debuginfo - update to 7.2.5-1.75.1
php72-sysvmsg - update to 7.2.5-1.75.1
php72-sqlite-debuginfo - update to 7.2.5-1.75.1
php72-sqlite - update to 7.2.5-1.75.1
php72-calendar-debuginfo - update to 7.2.5-1.75.1
php72-fastcgi - update to 7.2.5-1.75.1
php72-exif-debuginfo - update to 7.2.5-1.75.1
php72-exif - update to 7.2.5-1.75.1
php72-enchant-debuginfo - update to 7.2.5-1.75.1
php72-enchant - update to 7.2.5-1.75.1
php72-dom-debuginfo - update to 7.2.5-1.75.1
php72-dom - update to 7.2.5-1.75.1
php72-dba-debuginfo - update to 7.2.5-1.75.1
php72-dba - update to 7.2.5-1.75.1
php72-curl-debuginfo - update to 7.2.5-1.75.1
php72-curl - update to 7.2.5-1.75.1
php72-ctype-debuginfo - update to 7.2.5-1.75.1
php72-ctype - update to 7.2.5-1.75.1
php72-mysql-debuginfo - update to 7.2.5-1.75.1
php72-calendar - update to 7.2.5-1.75.1
php72-bz2-debuginfo - update to 7.2.5-1.75.1
php72-bz2 - update to 7.2.5-1.75.1
php72-bcmath-debuginfo - update to 7.2.5-1.75.1
php72-bcmath - update to 7.2.5-1.75.1
php72 - update to 7.2.5-1.75.1
apache2-mod_php72-debuginfo - update to 7.2.5-1.75.1
apache2-mod_php72 - update to 7.2.5-1.75.1
php72-devel - update to 7.2.5-1.75.1
php72-debugsource - update to 7.2.5-1.75.1
php72-odbc - update to 7.2.5-1.75.1
php72-debuginfo - update to 7.2.5-1.75.1
php72-fileinfo - update to 7.2.5-1.75.1
php72-fastcgi-debuginfo - update to 7.2.5-1.75.1
php72-mysql - update to 7.2.5-1.75.1
php72-mbstring-debuginfo - update to 7.2.5-1.75.1
php72-mbstring - update to 7.2.5-1.75.1
php72-ldap-debuginfo - update to 7.2.5-1.75.1
php72-ldap - update to 7.2.5-1.75.1
php72-json-debuginfo - update to 7.2.5-1.75.1
php72-json - update to 7.2.5-1.75.1
php72-intl-debuginfo - update to 7.2.5-1.75.1
php72-intl - update to 7.2.5-1.75.1
php72-imap-debuginfo - update to 7.2.5-1.75.1
php72-imap - update to 7.2.5-1.75.1
php72-iconv-debuginfo - update to 7.2.5-1.75.1
php72-gmp-debuginfo - update to 7.2.5-1.75.1
php72-iconv - update to 7.2.5-1.75.1
php72-fileinfo-debuginfo - update to 7.2.5-1.75.1
php72-fpm - update to 7.2.5-1.75.1
php72-fpm-debuginfo - update to 7.2.5-1.75.1
php72-ftp - update to 7.2.5-1.75.1
php72-ftp-debuginfo - update to 7.2.5-1.75.1
php72-gd - update to 7.2.5-1.75.1
php72-gd-debuginfo - update to 7.2.5-1.75.1
php72-gettext - update to 7.2.5-1.75.1
php72-gettext-debuginfo - update to 7.2.5-1.75.1
php72-gmp - update to 7.2.5-1.75.1
php7-posix - update to 7.2.5-4.89.4
php7-posix-debuginfo - update to 7.2.5-4.89.4
php7-readline - update to 7.2.5-4.89.4
php7-readline-debuginfo - update to 7.2.5-4.89.4
php7-shmop - update to 7.2.5-4.89.4
php7-shmop-debuginfo - update to 7.2.5-4.89.4
php7-snmp - update to 7.2.5-4.89.4
php7-snmp-debuginfo - update to 7.2.5-4.89.4
php7-soap - update to 7.2.5-4.89.4
php7-soap-debuginfo - update to 7.2.5-4.89.4
php7-sockets - update to 7.2.5-4.89.4
php7-sockets-debuginfo - update to 7.2.5-4.89.4
php7-sodium - update to 7.2.5-4.89.4
php7-sodium-debuginfo - update to 7.2.5-4.89.4
php7-phar-debuginfo - update to 7.2.5-4.89.4
php7-phar - update to 7.2.5-4.89.4
php7-pgsql-debuginfo - update to 7.2.5-4.89.4
php7-pgsql - update to 7.2.5-4.89.4
php7-pdo-debuginfo - update to 7.2.5-4.89.4
php7-pdo - update to 7.2.5-4.89.4
php7-pcntl-debuginfo - update to 7.2.5-4.89.4
php7-pcntl - update to 7.2.5-4.89.4
php7-openssl-debuginfo - update to 7.2.5-4.89.4
php7-openssl - update to 7.2.5-4.89.4
php7-opcache-debuginfo - update to 7.2.5-4.89.4
php7-opcache - update to 7.2.5-4.89.4
php7-pear-Archive_Tar - update to 7.2.5-4.89.4
php7-odbc-debuginfo - update to 7.2.5-4.89.4
php7-wddx-debuginfo - update to 7.2.5-4.89.4
php7-pear - update to 7.2.5-4.89.4
php7-zlib-debuginfo - update to 7.2.5-4.89.4
php7-zlib - update to 7.2.5-4.89.4
php7-zip-debuginfo - update to 7.2.5-4.89.4
php7-zip - update to 7.2.5-4.89.4
php7-xsl-debuginfo - update to 7.2.5-4.89.4
php7-xsl - update to 7.2.5-4.89.4
php7-xmlwriter-debuginfo - update to 7.2.5-4.89.4
php7-xmlwriter - update to 7.2.5-4.89.4
php7-xmlrpc-debuginfo - update to 7.2.5-4.89.4
php7-xmlrpc - update to 7.2.5-4.89.4
php7-xmlreader-debuginfo - update to 7.2.5-4.89.4
php7-xmlreader - update to 7.2.5-4.89.4
php7-sqlite - update to 7.2.5-4.89.4
php7-wddx - update to 7.2.5-4.89.4
php7-tokenizer-debuginfo - update to 7.2.5-4.89.4
php7-tokenizer - update to 7.2.5-4.89.4
php7-tidy-debuginfo - update to 7.2.5-4.89.4
php7-tidy - update to 7.2.5-4.89.4
php7-sysvshm-debuginfo - update to 7.2.5-4.89.4
php7-sysvshm - update to 7.2.5-4.89.4
php7-sysvsem-debuginfo - update to 7.2.5-4.89.4
php7-sysvsem - update to 7.2.5-4.89.4
php7-sysvmsg-debuginfo - update to 7.2.5-4.89.4
php7-sysvmsg - update to 7.2.5-4.89.4
php7-sqlite-debuginfo - update to 7.2.5-4.89.4
php7-curl-debuginfo - update to 7.2.5-4.89.4
php7-fastcgi - update to 7.2.5-4.89.4
php7-exif-debuginfo - update to 7.2.5-4.89.4
php7-exif - update to 7.2.5-4.89.4
php7-enchant-debuginfo - update to 7.2.5-4.89.4
php7-enchant - update to 7.2.5-4.89.4
php7-dom-debuginfo - update to 7.2.5-4.89.4
php7-dom - update to 7.2.5-4.89.4
php7-devel - update to 7.2.5-4.89.4
php7-debugsource - update to 7.2.5-4.89.4
php7-debuginfo - update to 7.2.5-4.89.4
php7-dba-debuginfo - update to 7.2.5-4.89.4
php7-dba - update to 7.2.5-4.89.4
php7-mysql-debuginfo - update to 7.2.5-4.89.4
php7-curl - update to 7.2.5-4.89.4
php7-ctype-debuginfo - update to 7.2.5-4.89.4
php7-ctype - update to 7.2.5-4.89.4
php7-calendar-debuginfo - update to 7.2.5-4.89.4
php7-calendar - update to 7.2.5-4.89.4
php7-bz2-debuginfo - update to 7.2.5-4.89.4
php7-bz2 - update to 7.2.5-4.89.4
php7-bcmath-debuginfo - update to 7.2.5-4.89.4
php7-bcmath - update to 7.2.5-4.89.4
php7 - update to 7.2.5-4.89.4
apache2-mod_php7-debuginfo - update to 7.2.5-4.89.4
apache2-mod_php7 - update to 7.2.5-4.89.4
php7-fileinfo - update to 7.2.5-4.89.4
php7-odbc - update to 7.2.5-4.89.4
php7-mysql - update to 7.2.5-4.89.4
php7-mbstring-debuginfo - update to 7.2.5-4.89.4
php7-mbstring - update to 7.2.5-4.89.4
php7-ldap-debuginfo - update to 7.2.5-4.89.4
php7-ldap - update to 7.2.5-4.89.4
php7-json-debuginfo - update to 7.2.5-4.89.4
php7-json - update to 7.2.5-4.89.4
php7-intl-debuginfo - update to 7.2.5-4.89.4
php7-intl - update to 7.2.5-4.89.4
php7-iconv-debuginfo - update to 7.2.5-4.89.4
php7-iconv - update to 7.2.5-4.89.4
php7-gmp-debuginfo - update to 7.2.5-4.89.4
php7-gmp - update to 7.2.5-4.89.4
php7-gettext-debuginfo - update to 7.2.5-4.89.4
php7-gettext - update to 7.2.5-4.89.4
php7-gd-debuginfo - update to 7.2.5-4.89.4
php7-gd - update to 7.2.5-4.89.4
php7-ftp-debuginfo - update to 7.2.5-4.89.4
php7-ftp - update to 7.2.5-4.89.4
php7-fpm-debuginfo - update to 7.2.5-4.89.4
php7-fpm - update to 7.2.5-4.89.4
php7-fileinfo-debuginfo - update to 7.2.5-4.89.4
php7-fastcgi-debuginfo - update to 7.2.5-4.89.4

• https://bugs.php.net/bug.php?id=70185
• https://bugs.php.net/bug.php?id=73342
• https://bugs.php.net/bug.php?id=75968

• Denial of service in PHP
• Ubuntu update for PHP
• Ubuntu update for PHP
• Resource exhaustion in php7 (Alpine package)
• SUSE update for php72
• SUSE update for php7