CVE-2015-4642: OS Command Injection

Q: What is the severity of CVE-2015-4642?

CVE-2015-4642 is considered a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary OS commands.

Q: How do I fix CVE-2015-4642?

To mitigate CVE-2015-4642, upgrade to PHP versions 5.4.42, 5.5.26, or 5.6.10 and later.

Q: Which PHP versions are affected by CVE-2015-4642?

CVE-2015-4642 affects PHP versions before 5.4.42, all 5.5.x versions before 5.5.26, and all 5.6.x versions before 5.6.10.

Q: Can CVE-2015-4642 be exploited on Windows systems?

Yes, CVE-2015-4642 can be exploited on Windows systems running vulnerable versions of PHP.

Q: What types of applications are at risk from CVE-2015-4642?

Applications that utilize the PHP system function and pass user input to it are at risk of CVE-2015-4642.

Published May 16, 2016

Updated

The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system function.

Affected Software

38 affected components

Microsoft Windows

PHP PHP<=5.4.41

PHP PHP=5.5.0

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.5.25

PHP PHP=5.6.0

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

Event History

May 16, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4642?

CVE-2015-4642 is considered a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary OS commands.

How do I fix CVE-2015-4642?

To mitigate CVE-2015-4642, upgrade to PHP versions 5.4.42, 5.5.26, or 5.6.10 and later.

Which PHP versions are affected by CVE-2015-4642?