CVE-2015-7804: Medium severity apple ios and macos vulnerability

Q: What versions of PHP are affected by CVE-2015-7804?

CVE-2015-7804 affects PHP versions before 5.5.30 and 5.6.x before 5.6.14.

Q: What is the impact of CVE-2015-7804?

The impact of CVE-2015-7804 is a denial of service due to an uninitialized pointer dereference and application crash.

Q: How can I mitigate CVE-2015-7804?

Mitigation for CVE-2015-7804 can be achieved by upgrading PHP to versions 5.5.30 or 5.6.14 and above.

Q: What is an off-by-one error in the context of CVE-2015-7804?

In the context of CVE-2015-7804, an off-by-one error refers to a coding mistake that leads to incorrect handling of data boundaries, causing crashes.

Q: Is CVE-2015-7804 a critical vulnerability?

CVE-2015-7804 is not classified as critical but poses a significant risk due to potential denial of service.

Published Dec 11, 2015

Updated

Off-by-one error in the pharparsezipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (uninitialized pointer dereference and application crash) by including the / filename in a .zip PHAR archive.

Affected Software

16 affected components

Apple iOS and macOS<=10.11.1

PHP PHP<=5.5.29

PHP PHP=5.6.0

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

PHP PHP=5.6.5

PHP PHP=5.6.6

PHP PHP=5.6.7

PHP PHP=5.6.8

PHP PHP=5.6.9

PHP PHP=5.6.10

PHP PHP=5.6.11

PHP PHP=5.6.12

PHP PHP=5.6.13

Event History

Dec 11, 2015

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What versions of PHP are affected by CVE-2015-7804?

CVE-2015-7804 affects PHP versions before 5.5.30 and 5.6.x before 5.6.14.

What is the impact of CVE-2015-7804?

The impact of CVE-2015-7804 is a denial of service due to an uninitialized pointer dereference and application crash.

How can I mitigate CVE-2015-7804?