CVE-2015-8617: Critical severity php vulnerability
Format string vulnerability in the zendthroworerror function in Zend/zendexecuteAPI.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.
Other sources
Fixed bug (Format String Vulnerability in Class Name Error Message). (CVE-2015-8617)
— PHP
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8617?
CVE-2015-8617 is classified as a high severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2015-8617?
To fix CVE-2015-8617, upgrade PHP to version 7.0.1 or later.
What systems are affected by CVE-2015-8617?
CVE-2015-8617 affects PHP versions prior to 7.0.1.
What type of vulnerability is CVE-2015-8617?
CVE-2015-8617 is a format string vulnerability that can lead to arbitrary code execution.
What can attackers do with CVE-2015-8617?
Attackers can exploit CVE-2015-8617 to execute arbitrary code by manipulating format string specifiers in class names.