CVE-2015-7803: Null Pointer Dereference

Q: What is the severity of CVE-2015-7803?

CVE-2015-7803 is classified as a denial of service vulnerability that can cause an application crash.

Q: How do I fix CVE-2015-7803?

To fix CVE-2015-7803, upgrade PHP to version 5.5.30 or later, or to 5.6.14 or later.

Q: Which versions of PHP are affected by CVE-2015-7803?

CVE-2015-7803 affects PHP versions prior to 5.5.30 and 5.6.x prior to 5.6.14.

Q: What kind of attack does CVE-2015-7803 involve?

CVE-2015-7803 involves a remote attacker exploiting a crafted .phar file to trigger a NULL pointer dereference.

Q: Can CVE-2015-7803 impact systems running macOS?

Yes, CVE-2015-7803 can impact systems running macOS that use the affected versions of PHP.

Published Dec 11, 2015

Updated

The phargetentrydata function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a .phar file with a crafted TAR archive entry in which the Link indicator references a file that does not exist.

Affected Software

15 affected components

PHP PHP<=5.5.29

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP=5.6.13

Apple iOS and macOS<=10.11.1

Event History

Dec 11, 2015

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-7803?

CVE-2015-7803 is classified as a denial of service vulnerability that can cause an application crash.

How do I fix CVE-2015-7803?

To fix CVE-2015-7803, upgrade PHP to version 5.5.30 or later, or to 5.6.14 or later.

Which versions of PHP are affected by CVE-2015-7803?