CVE-2015-4605: Input Validation

Q: What is the severity of CVE-2015-4605?

CVE-2015-4605 is classified as a denial-of-service vulnerability that can cause an application crash.

Q: How do I fix CVE-2015-4605?

To fix CVE-2015-4605, upgrade PHP to version 5.4.40, 5.5.24, or 5.6.8 or later.

Q: Who is affected by CVE-2015-4605?

CVE-2015-4605 affects PHP versions prior to 5.4.40, 5.5.x prior to 5.5.24, and 5.6.x prior to 5.6.8.

Q: What causes CVE-2015-4605?

CVE-2015-4605 is caused by the mcopy function in softmagic.c not properly restricting certain offset values.

Q: Can CVE-2015-4605 lead to remote code execution?

While CVE-2015-4605 primarily leads to denial of service, it may also pose risks for potential remote code execution.

Published May 16, 2016

Updated

The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.

Affected Software

41 affected components

PHP PHP<=5.4.39

PHP PHP=5.5.0

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.6.0

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

redhat Enterprise Linux Desktop=7.0

redhat Enterprise Linux Hpc Node=7.0

redhat Enterprise Linux Hpc Node Eus=7.1

redhat Enterprise Linux Server=7.0

redhat Enterprise Linux Server Eus=7.1

redhat Enterprise Linux Workstation=7.0

redhat Enterprise Linux=6.0

redhat Enterprise Linux=7.0

Event History

May 16, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4605?

CVE-2015-4605 is classified as a denial-of-service vulnerability that can cause an application crash.

How do I fix CVE-2015-4605?

To fix CVE-2015-4605, upgrade PHP to version 5.4.40, 5.5.24, or 5.6.8 or later.

Who is affected by CVE-2015-4605?