CVE-2015-4604

原文の説明

The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.

影響を受けるソフトウェア

• PHP = 5.5.0= 5.6.4= 5.5.14= 5.6.5= 5.5.7= 5.5.1 完全一致

詳細

公開日

2016-05-16

最終更新

2024-08-06

CVSS ベクター

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

参考資料

• cve.org/CVE-2015-4604
• nvd.nist.gov/vuln/detail/CVE-2015-4604
• rhn.redhat.com/errata/RHSA-2015-1187.html
• www.securitytracker.com/id/1032709
• rhn.redhat.com/errata/RHSA-2015-1186.html
• bugs.php.net/bug.php?id=68819
• www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
• www.securityfocus.com/bid/75241
• php.net/ChangeLog-5.php
• www.openwall.com/lists/oss-security/2015/06/16/12
• git.php.net/?p=php-src.git%3Ba=commit%3Bh=f938112c495b0d26572435c0be73ac0bfe642ecd
• rhn.redhat.com/errata/RHSA-2015-1135.html