CVE-2015-6833: Path Traversal

Q: What is the severity of CVE-2015-6833?

CVE-2015-6833 has a medium severity rating due to its potential to allow unauthorized access to arbitrary files on the server.

Q: How can I mitigate CVE-2015-6833?

To mitigate CVE-2015-6833, upgrade your PHP version to 5.4.44 or later, 5.5.28 or later, or 5.6.12 or later.

Q: What systems are affected by CVE-2015-6833?

CVE-2015-6833 affects PHP versions prior to 5.4.44, all 5.5.x versions prior to 5.5.28, and all 5.6.x versions prior to 5.6.12.

Q: What type of attack does CVE-2015-6833 facilitate?

CVE-2015-6833 facilitates directory traversal attacks, enabling attackers to write files outside of the intended directory.

Q: Is CVE-2015-6833 present in PHP’s PharData class?

Yes, CVE-2015-6833 is specifically a directory traversal vulnerability found in PHP's PharData class.

Published Jan 19, 2016

Updated

Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. (dot dot) in a ZIP archive entry that is mishandled during an extractTo call.

Affected Software

58 affected components

PHP PHP<=5.4.43

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.5.21

PHP PHP=5.5.22

PHP PHP=5.5.23

PHP PHP=5.5.24

PHP PHP=5.5.25

PHP PHP=5.5.26

PHP PHP=5.5.27

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

Event History

Jan 19, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6833?

CVE-2015-6833 has a medium severity rating due to its potential to allow unauthorized access to arbitrary files on the server.

How can I mitigate CVE-2015-6833?

To mitigate CVE-2015-6833, upgrade your PHP version to 5.4.44 or later, 5.5.28 or later, or 5.6.12 or later.

What systems are affected by CVE-2015-6833?