CVE-2015-3412: Infoleak
PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the streamresolveincludepath function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3412?
CVE-2015-3412 has a moderate severity rating due to its potential for file inclusion vulnerabilities.
How do I fix CVE-2015-3412?
To fix CVE-2015-3412, upgrade PHP to version 5.4.40, 5.5.24, or 5.6.8 or later.
What versions of PHP are affected by CVE-2015-3412?
CVE-2015-3412 affects PHP versions prior to 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8.
What type of vulnerability is CVE-2015-3412?
CVE-2015-3412 is a file inclusion vulnerability that may allow remote attackers to read arbitrary files.
Can I mitigate the risk of CVE-2015-3412 without upgrading?
Mitigation options are limited; the best practice is to upgrade to a patched version of PHP.