CVE-2015-4021: Medium severity red hat enterprise linux desktop vulnerability

Q: What is the severity of CVE-2015-4021?

CVE-2015-4021 has been classified as a moderate severity vulnerability due to its potential to cause denial of service.

Q: How do I fix CVE-2015-4021?

To fix CVE-2015-4021, update PHP to version 5.4.41, 5.5.25, or 5.6.9 or later.

Q: What systems are affected by CVE-2015-4021?

CVE-2015-4021 affects PHP versions prior to 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9.

Q: What type of vulnerability is CVE-2015-4021?

CVE-2015-4021 is a denial of service vulnerability that can be exploited through the phar_parse_tarfile function.

Q: What could happen if CVE-2015-4021 is exploited?

If exploited, CVE-2015-4021 could lead to an integer underflow and potential memory corruption, resulting in service disruption.

Published Jun 9, 2015

Updated

The pharparsetarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.

Affected Software

61 affected components

redhat Enterprise Linux Desktop=7.0

redhat Enterprise Linux Hpc Node=7.0

redhat Enterprise Linux Hpc Node Eus=7.1

redhat Enterprise Linux Server=7.0

redhat Enterprise Linux Server Eus=7.1

redhat Enterprise Linux Workstation=7.0

Apple iOS and macOS<=10.10.4

redhat Enterprise Linux=6.0

redhat Enterprise Linux=7.0

PHP PHP<=5.4.40

PHP PHP=5.4.39

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

Remediation

Patch Available

http://php.net/ChangeLog-5.php

Event History

Jun 9, 2015

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4021?

CVE-2015-4021 has been classified as a moderate severity vulnerability due to its potential to cause denial of service.

How do I fix CVE-2015-4021?