CVE-2015-4604: Input Validation

Q: What is the severity of CVE-2015-4604?

CVE-2015-4604 is classified as a vulnerability that can lead to denial of service through an application crash.

Q: How do I fix CVE-2015-4604?

To fix CVE-2015-4604, you should upgrade to PHP versions 5.4.40, 5.5.24, 5.6.8, or later.

Q: Which versions of PHP are affected by CVE-2015-4604?

CVE-2015-4604 affects PHP versions prior to 5.4.40, 5.5.24, and 5.6.8.

Q: What is the impact of exploiting CVE-2015-4604?

Exploiting CVE-2015-4604 may result in remote attackers causing a denial of service via application crashes.

Q: Is CVE-2015-4604 related to any specific component in PHP?

CVE-2015-4604 specifically affects the Fileinfo component in PHP due to issues in the mget function.

Published May 16, 2016

Updated

The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.

Affected Software

41 affected components

PHP PHP<=5.4.39

PHP PHP=5.5.0

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.6.0

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

redhat Enterprise Linux Desktop=7.0

redhat Enterprise Linux Hpc Node=7.0

redhat Enterprise Linux Hpc Node Eus=7.1

redhat Enterprise Linux Server=7.0

redhat Enterprise Linux Server Eus=7.1

redhat Enterprise Linux Workstation=7.0

redhat Enterprise Linux=6.0

redhat Enterprise Linux=7.0

Event History

May 16, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4604?

CVE-2015-4604 is classified as a vulnerability that can lead to denial of service through an application crash.

How do I fix CVE-2015-4604?

To fix CVE-2015-4604, you should upgrade to PHP versions 5.4.40, 5.5.24, 5.6.8, or later.

Which versions of PHP are affected by CVE-2015-4604?