CVE-2015-5590: Buffer Overflow

Q: What is the severity of CVE-2015-5590?

CVE-2015-5590 has a high severity level due to the potential for remote attackers to cause a denial of service.

Q: How do I fix CVE-2015-5590?

To mitigate CVE-2015-5590, upgrade PHP to versions 5.4.43, 5.5.27, or 5.6.11 or later.

Q: What systems are affected by CVE-2015-5590?

CVE-2015-5590 affects PHP versions prior to 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11.

Q: What attack vectors are associated with CVE-2015-5590?

CVE-2015-5590 allows remote attackers to exploit a stack-based buffer overflow via a large length value.

Q: Is there a workaround for CVE-2015-5590 if I cannot update PHP?

There are no reliable workarounds for CVE-2015-5590, so upgrading PHP is the recommended approach.

Published Jan 19, 2016

Updated

Stack-based buffer overflow in the pharfixfilepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value, as demonstrated by mishandling of an e-mail attachment by the imap PHP extension.

Affected Software

56 affected components

PHP PHP<=5.4.42

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.5.25

PHP PHP=5.5.26

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

Event History

Jan 19, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-5590?

CVE-2015-5590 has a high severity level due to the potential for remote attackers to cause a denial of service.

How do I fix CVE-2015-5590?

To mitigate CVE-2015-5590, upgrade PHP to versions 5.4.43, 5.5.27, or 5.6.11 or later.

What systems are affected by CVE-2015-5590?