CVE-2015-4602: Critical severity red hat enterprise linux vulnerability

Q: What is the severity of CVE-2015-4602?

CVE-2015-4602 is identified with a severity rating that indicates the potential for denial of service or remote code execution.

Q: How do I fix CVE-2015-4602?

To fix CVE-2015-4602, upgrade PHP to version 5.4.40 or later, 5.5.24 or later, or 5.6.8 or later.

Q: What systems are affected by CVE-2015-4602?

CVE-2015-4602 affects various versions of PHP prior to specified patched versions and is also relevant to certain Red Hat Enterprise Linux versions.

Q: What types of attacks can be executed using CVE-2015-4602?

CVE-2015-4602 can lead to attacks that result in application crashes or potentially executable arbitrary code due to type confusion.

Q: Is there a workaround for CVE-2015-4602 until I can apply a fix?

While a specific workaround is not provided, it's advisable to restrict access to the affected PHP applications until they can be patched.

Published May 16, 2016

Updated

The PHPIncompleteClass function in ext/standard/incompleteclass.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

Affected Software

41 affected components

redhat Enterprise Linux=6.0

redhat Enterprise Linux=7.0

PHP PHP<=5.4.39

PHP PHP=5.5.0

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.6.0

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

redhat Enterprise Linux Desktop=7.0

redhat Enterprise Linux Hpc Node=7.0

redhat Enterprise Linux Hpc Node Eus=7.1

redhat Enterprise Linux Server=7.0

redhat Enterprise Linux Server Eus=7.1

redhat Enterprise Linux Workstation=7.0

Event History

May 16, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4602?

CVE-2015-4602 is identified with a severity rating that indicates the potential for denial of service or remote code execution.

How do I fix CVE-2015-4602?

To fix CVE-2015-4602, upgrade PHP to version 5.4.40 or later, 5.5.24 or later, or 5.6.8 or later.

What systems are affected by CVE-2015-4602?