Integer underflow in PHP - CVE-2015-4021
Published: November 27, 2018
Vulnerability identifier: #VU16119
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-4021
CWE-ID: CWE-191
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to the phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the character. A remote attacker can trigger integer underflow and memory corruption)via a crafted entry in a tar archive and cause the service to crash.
The weakness exists due to the phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the character. A remote attacker can trigger integer underflow and memory corruption)via a crafted entry in a tar archive and cause the service to crash.
Affected software
PHP
Amazon Linux AMI
Slackware Linux
Fedora
php5 (Ubuntu package)
php
Amazon Linux AMI
Slackware Linux
Fedora
php5 (Ubuntu package)
php
How to mitigate CVE-2015-4021
Install update from vendor's website.
PHP - addressed in versions 5.4.41, 5.5.25, 5.6.9
php5 (Ubuntu package) - addressed in versions 5.3.10-1ubuntu3.19, 5.5.9+dfsg-1ubuntu4.11, 5.5.12+dfsg-2ubuntu4.6, 5.6.4+dfsg-4ubuntu6.2
php - addressed in versions 5.6.9-1.fc21, 5.6.9-1.fc22
php5 (Ubuntu package) - addressed in versions 5.3.10-1ubuntu3.19, 5.5.9+dfsg-1ubuntu4.11, 5.5.12+dfsg-2ubuntu4.6, 5.6.4+dfsg-4ubuntu6.2
php - addressed in versions 5.6.9-1.fc21, 5.6.9-1.fc22