CVE-2015-9253 An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution func...
MediumCVSS 6.5
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | < 7.1.20 | 7.1.20 |
| PHP | >= 7.2.0, < 7.2.8 | 7.2.8 |
| PHP | = 7.3.0-alpha1 | No fix listed |
| PHP | = 7.3.0-alpha2 | No fix listed |
| alpine/php7(Alpine:v3.10) | < 7.2.8-r0 | 7.2.8-r0 |
| alpine/php7(Alpine:v3.11) | < 7.2.8-r0 | 7.2.8-r0 |
| alpine/php7(Alpine:v3.12) | < 7.2.8-r0 | 7.2.8-r0 |
| alpine/php7(Alpine:v3.13) | < 7.2.8-r0 | 7.2.8-r0 |
| alpine/php7(Alpine:v3.14) | < 7.2.8-r0 | 7.2.8-r0 |
| alpine/php7(Alpine:v3.15) | < 7.2.8-r0 | 7.2.8-r0 |
| alpine/php7(Alpine:v3.8) | < 7.2.8-r0 | 7.2.8-r0 |
| alpine/php7(Alpine:v3.9) | < 7.2.8-r0 | 7.2.8-r0 |
References
- bugs.php.net exploit issue-tracking vendor-advisory
- bugs.php.net exploit issue-tracking vendor-advisory
- bugs.php.net exploit issue-tracking vendor-advisory
- github.com third-party-advisory
- github.com patch third-party-advisory
- USN-3766-1 third-party-advisory vendor-advisory
- USN-4279-1 vendor-advisory
- www.futureweb.at exploit third-party-advisory
- security.alpinelinux.org vendor-advisory