CVE-2015-8867
First published: Sun May 22 2016(Updated: )
The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PHP | <7.0.0 | 7.0.0 |
| PHP | >=5.4.0<5.4.44 | |
| PHP | >=5.5.0<5.5.28 | |
| PHP | >=5.6.0<5.6.12 | |
| Ubuntu | =12.04 | |
| Ubuntu | =14.04 | |
| Ubuntu | =15.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.php.net/?p=php-src.git;a=commit;h=16023f3e3b9c06cf677c3c980e8d574e4c162827
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00056.html
- http://rhn.redhat.com/errata/RHSA-2016-2750.html
- http://www.openwall.com/lists/oss-security/2016/04/24/1
- http://www.php.net/ChangeLog-5.php
- http://www.php.net/ChangeLog-7.php
- http://www.ubuntu.com/usn/USN-2952-1
- http://www.ubuntu.com/usn/USN-2952-2
- https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1534203
- https://bugs.php.net/bug.php?id=70014
- https://www.php.net/ChangeLog-7.php#7.0.0 (Advisory)
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=16023f3e3b9c06cf677c3c980e8d574e4c162827
Frequently Asked Questions
What is the severity of CVE-2015-8867?
CVE-2015-8867 is considered a medium severity vulnerability due to its potential impact on cryptographic protection mechanisms.
How do I fix CVE-2015-8867?
To fix CVE-2015-8867, upgrade PHP to version 5.4.44, 5.5.28, 5.6.12 or later.
Which PHP versions are affected by CVE-2015-8867?
CVE-2015-8867 affects PHP versions prior to 5.4.44, 5.5.28, and 5.6.12.
What are the implications of CVE-2015-8867 for my application?
CVE-2015-8867 could allow remote attackers to undermine cryptographic protections in your application.
Is CVE-2015-8867 specific to certain operating systems?
CVE-2015-8867 impacts PHP installations across various operating systems, including specific versions of Ubuntu.
- agent/type
- agent/severity
- agent/author
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/event
- agent/first-publish-date
- agent/source
- collector/php-changelog
- source/PHP
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- vendor/php
- canonical/php
- version/php/5.4.0
- version/php/5.5.0
- version/php/5.6.0
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/12.04
- version/ubuntu/14.04
- version/ubuntu/15.10