CVE-2015-2331: Buffer Overflow

Q: What is the severity of CVE-2015-2331?

The severity of CVE-2015-2331 is considered to be high due to the potential for denial of service and possible remote code execution.

Q: How do I fix CVE-2015-2331?

To fix CVE-2015-2331, update the affected software to a version that is not susceptible to this vulnerability, such as libzip version 0.11.3 or later, or PHP versions 5.4.39, 5.5.23, or 5.6.7 and later.

Q: Who is affected by CVE-2015-2331?

CVE-2015-2331 affects users of libzip versions up to 0.11.2 and PHP versions before 5.4.39, as well as various other products reliant on these libraries.

Q: What kind of attack can be executed with CVE-2015-2331?

CVE-2015-2331 can be exploited to crash applications, causing denial of service, and could potentially lead to remote code execution under certain conditions.

Q: When was CVE-2015-2331 discovered?

CVE-2015-2331 was publicly disclosed in 2015.

Published Mar 30, 2015

Updated

Integer overflow in the zipcdirnew function in zipdirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.

Affected Software

56 affected components

Nih Libzip<=0.11.2

PHP PHP<=5.4.38

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

Debian Debian Linux=7.0

Fedoraproject Fedora=22

openSUSE openSUSE=13.1

openSUSE openSUSE=13.2

Event History

Mar 30, 2015

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-2331?

The severity of CVE-2015-2331 is considered to be high due to the potential for denial of service and possible remote code execution.

How do I fix CVE-2015-2331?

To fix CVE-2015-2331, update the affected software to a version that is not susceptible to this vulnerability, such as libzip version 0.11.3 or later, or PHP versions 5.4.39, 5.5.23, or 5.6.7 and later.

Who is affected by CVE-2015-2331?