CVE-2015-8867
First published: Sun May 22 2016(Updated: )
The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PHP PHP | >=5.4.0<5.4.44 | |
| PHP PHP | >=5.5.0<5.5.28 | |
| PHP PHP | >=5.6.0<5.6.12 | |
| Canonical Ubuntu Linux | =12.04 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =15.10 | |
| <7.0.0 | 7.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.php.net/?p=php-src.git;a=commit;h=16023f3e3b9c06cf677c3c980e8d574e4c162827
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00056.html
- http://rhn.redhat.com/errata/RHSA-2016-2750.html
- http://www.openwall.com/lists/oss-security/2016/04/24/1
- http://www.php.net/ChangeLog-5.php
- http://www.php.net/ChangeLog-7.php
- http://www.ubuntu.com/usn/USN-2952-1
- http://www.ubuntu.com/usn/USN-2952-2
- https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1534203
- https://bugs.php.net/bug.php?id=70014
- https://www.php.net/ChangeLog-7.php#7.0.0 (Advisory)
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=16023f3e3b9c06cf677c3c980e8d574e4c162827
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- collector/php-changelog
- source/PHP
- agent/software-canonical-lookup
- agent/severity
- agent/author
- agent/weakness
- agent/references
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/php
- canonical/php php
- version/php php/5.4.0
- version/php php/5.5.0
- version/php php/5.6.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/12.04
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/15.10