CVE-2015-2301: Use After Free
Use after free vulnerability reported in PHP "phar" extension [1]. Upstream commit that fixes this: http://git.php.net/?p=php-src.git;a=commit;h=b2cf3f064b8f5efef89bb084521b61318c71781b
[1]: https://bugs.php.net/bug.php?id=68901
Other sources
Use-after-free vulnerability in the pharrenamearchive function in pharobject.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2301?
CVE-2015-2301 is classified as a high severity vulnerability due to the potential for arbitrary code execution through the PHP 'phar' extension.
How do I fix CVE-2015-2301?
To fix CVE-2015-2301, update PHP to version 5.5.22 or 5.6.6 or later, as those versions contain the necessary security patches.
Which PHP versions are affected by CVE-2015-2301?
CVE-2015-2301 affects PHP versions from 5.4.0 up to 5.4.40, 5.5.0 up to 5.5.22, and 5.6.0 up to 5.6.6.
What types of systems are affected by CVE-2015-2301?
CVE-2015-2301 affects several systems, including specific versions of Ubuntu, Debian, openSUSE, and Red Hat Enterprise Linux.
Is CVE-2015-2301 exploitable remotely?
Yes, CVE-2015-2301 can be exploited remotely, allowing attackers to execute malicious code on affected systems.