CVE-2015-4643 Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to...
CriticalCVSS 9.8
EPSS 15.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | < 5.4.42 | 5.4.42 |
| PHP | >= 5.5.0, < 5.5.26 | 5.5.26 |
| PHP | >= 5.6.0, < 5.6.10 | 5.6.10 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 6.6 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 6.6 | No fix listed |
| redhat enterprise linux server eus | = 7.1 | No fix listed |
| redhat enterprise linux server eus | = 7.2 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 6.6 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7-0 | No fix listed |
References
- git.php.net
- [oss-security] 20150618 Re: PHP 5.6.10 / 5.5.26 / 5.4.42 CVE request mailing-list patch third-party-advisory
- php.net release-notes vendor-advisory
- RHSA-2015:1135 third-party-advisory vendor-advisory
- RHSA-2015:1186 third-party-advisory vendor-advisory
- RHSA-2015:1187 third-party-advisory vendor-advisory
- RHSA-2015:1218 third-party-advisory vendor-advisory
- DSA-3344 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- 75291 third-party-advisory vdb-entry
- 1032709 third-party-advisory vdb-entry
- bugs.php.net exploit issue-tracking vendor-advisory
- GLSA-201606-10 third-party-advisory vendor-advisory