CVE-2015-4644: Null Pointer Dereference

Q: What is the severity of CVE-2015-4644?

CVE-2015-4644 is considered to have a moderate severity level due to the potential for denial of service.

Q: How do I fix CVE-2015-4644?

To fix CVE-2015-4644, upgrade PHP to version 5.4.42, 5.5.26, or 5.6.10 or later.

Q: Which versions of PHP are affected by CVE-2015-4644?

CVE-2015-4644 affects PHP versions prior to 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10.

Q: Does CVE-2015-4644 affect all operating systems?

CVE-2015-4644 specifically affects PHP installations on Red Hat Enterprise Linux 6.0 and 7.0.

Q: What kind of attacks can CVE-2015-4644 enable?

CVE-2015-4644 can enable remote attackers to cause a denial of service through null pointer dereference.

Published May 16, 2016

Updated

The phppgsqlmetadata function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token extraction for table names, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1352.

Affected Software

39 affected components

redhat Enterprise Linux=6.0

redhat Enterprise Linux=7.0

PHP PHP<=5.4.41

PHP PHP=5.5.0

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.5.25

PHP PHP=5.6.0

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

Event History

May 16, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4644?

CVE-2015-4644 is considered to have a moderate severity level due to the potential for denial of service.

How do I fix CVE-2015-4644?

To fix CVE-2015-4644, upgrade PHP to version 5.4.42, 5.5.26, or 5.6.10 or later.

Which versions of PHP are affected by CVE-2015-4644?