high
7.5
CWE
119
Advisory Published
CVE Published
Updated

CVE-2015-3307: Buffer Overflow

First published: Wed May 20 2015(Updated: )

A vulnerability in PHP was reported whereby the Heap header gets misaligned resulting in the corruption of the heap chunk's metadata. A heap chunk is allocated in ext/phar/tar.c:167 metadata = (char *) safe_emalloc(1, entry-&gt;uncompressed_filesize, 1); A reference to this heap chunk is passed into phar_parse_metadata() at ext/phar/tar.c:176 if (phar_parse_metadata(&amp;metadata, &amp;entry-&gt;metadata, entry-&gt;uncompressed_filesize TSRMLS_CC) == FAILURE) { The following gets called within phar_parse_metadata:611 when zip_metadata_len==0 PHAR_GET_32(*buffer, buf_len); This moves the pointer referencing the heap chunk by 4 bytes. When the heap chunk gets freeed at at tar.c:177: efree(metadata); The heap chunk is now misaligned by 4 bytes. In other words: ZEND_MM_HEADER_OF(metadata).info._size is now ZEND_MM_HEADER_OF(metadata).info._prev and ZEND_MM_HEADER_OF(metadata).info._prev is tainted with the body's data. Upstream bug: <a href="https://bugs.php.net/bug.php?id=69443">https://bugs.php.net/bug.php?id=69443</a> Upstream patch: <a href="http://git.php.net/?p=php-src.git;a=commitdiff;h=17cbd0b5b78a7500f185b3781a2149881bfff8ae">http://git.php.net/?p=php-src.git;a=commitdiff;h=17cbd0b5b78a7500f185b3781a2149881bfff8ae</a> This patch was for <a href="https://access.redhat.com/security/cve/CVE-2015-2783">CVE-2015-2783</a> (<a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - CVE-2015-2783 php: buffer over-read in Phar metadata parsing" href="show_bug.cgi?id=1213446">bug 1213446</a>), but it inadvertently resolved this vulnerability as well. The vulnerable line that was removed was on ext/phar/phar.c:611 PHAR_GET_32(*buffer, buf_len);

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
redhat/php<5.4.40
5.4.40
redhat/php<5.5.24
5.5.24
redhat/php<5.6.8
5.6.8
redhat enterprise Linux desktop=7.0
Red Hat Enterprise Linux HPC Node=7.0
Red Hat Enterprise Linux HPC Node=7.1
redhat enterprise Linux server=7.0
redhat enterprise Linux server eus=7.1
redhat enterprise Linux workstation=7.0
Red Hat Enterprise Linux=6.0
Red Hat Enterprise Linux=7.0
macOS Yosemite<=10.10.4
PHP<=5.4.39
PHP=5.5.0
PHP=5.5.0-alpha1
PHP=5.5.0-alpha2
PHP=5.5.0-alpha3
PHP=5.5.0-alpha4
PHP=5.5.0-alpha5
PHP=5.5.0-alpha6
PHP=5.5.0-beta1
PHP=5.5.0-beta2
PHP=5.5.0-beta3
PHP=5.5.0-beta4
PHP=5.5.0-rc1
PHP=5.5.0-rc2
PHP=5.5.1
PHP=5.5.2
PHP=5.5.3
PHP=5.5.4
PHP=5.5.5
PHP=5.5.6
PHP=5.5.7
PHP=5.5.8
PHP=5.5.9
PHP=5.5.10
PHP=5.5.11
PHP=5.5.12
PHP=5.5.13
PHP=5.5.14
PHP=5.5.18
PHP=5.5.19
PHP=5.5.20
PHP=5.5.21
PHP=5.5.22
PHP=5.5.23
PHP=5.6.0-alpha1
PHP=5.6.0-alpha2
PHP=5.6.0-alpha3
PHP=5.6.0-alpha4
PHP=5.6.0-alpha5
PHP=5.6.0-beta1
PHP=5.6.0-beta2
PHP=5.6.0-beta3
PHP=5.6.0-beta4
PHP=5.6.2
PHP=5.6.3
PHP=5.6.4
PHP=5.6.5
PHP=5.6.6
PHP=5.6.7

Remedy

https://bugs.php.net/bug.php?id=69443

Remedy

https://bugzilla.redhat.com/show_bug.cgi?id=1223441

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2015-3307?

    CVE-2015-3307 has a moderate severity rating, which indicates a potential impact on the affected systems.

  • How do I fix CVE-2015-3307?

    To fix CVE-2015-3307, update PHP to a version higher than 5.4.40 or 5.5.24 or 5.6.8 depending on your installed version.

  • What versions of PHP are affected by CVE-2015-3307?

    CVE-2015-3307 affects PHP versions earlier than 5.4.40, 5.5.24, and 5.6.8.

  • How does CVE-2015-3307 affect PHP applications?

    CVE-2015-3307 can lead to heap corruption, which may result in unexpected behavior or crashes in PHP applications.

  • Is there a workaround for CVE-2015-3307?

    There is no official workaround for CVE-2015-3307; the best mitigation is to update to a fixed version.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203