CVE-2015-8879: Input Validation
The odbcbindcols function in ext/odbc/phpodbc.c in PHP before 5.6.12 mishandles driver behavior for SQLWVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbcfetcharray function to access a certain type of Microsoft SQL Server table.
Other sources
Fixed bug (PHP segfaults when accessing nvarchar(max) defined columns. (CVE-2015-8879)
— PHP
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8879?
CVE-2015-8879 has a low severity rating, but it can lead to denial of service due to application crashes.
How do I fix CVE-2015-8879?
To fix CVE-2015-8879, upgrade PHP to version 5.6.12 or later, or to version 7.0.0 or higher.
Which versions of PHP are affected by CVE-2015-8879?
PHP versions before 5.6.12 and 7.0.0, including versions 5.5.38 and 5.6.0 to 5.6.11, are affected by CVE-2015-8879.
What vulnerability does CVE-2015-8879 address?
CVE-2015-8879 addresses a vulnerability in the odbc_bindcols function that mishandles driver behavior for SQL_WVARCHAR columns.
Who can exploit CVE-2015-8879?
Remote attackers can exploit CVE-2015-8879 to cause denial of service in specific scenarios.