Stack-based Buffer Overflow in PHP5
Summary
DLA-1326-1: php5 - security update. Affects php5 versions < 5.4.45-0+deb7u13. Fixed in 5.4.45-0+deb7u13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP5 is a popular scripting language used for web development. It provides a wide range of functionality for creating dynamic web pages and applications. The vulnerability in PHP5 allows for a stack-based buffer overflow when parsing a malformed HTTP response. This can be exploited to cause a denial-of-service attack.
Vulnerability Detail
The stack-based buffer overflow vulnerability in PHP5 occurs when the software attempts to process a malformed HTTP response. An attacker can craft a specially crafted response that triggers the overflow, causing the application to crash or become unresponsive. This can lead to a denial-of-service situation, where legitimate users are unable to access the affected application or service. The vulnerability is present in versions of PHP5 prior to 5.4.45-0+deb7u13.
How To Fix
Minimum fixed version
5.4.45-0+deb7u13
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned above as soon as possible.
Conclusion
The stack-based buffer overflow vulnerability in PHP5 can be exploited to cause a denial-of-service attack. It is important to upgrade to the fixed version of php5 (5.4.45-0+deb7u13) or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
The vulnerability allows an attacker to cause a denial-of-service by crashing the affected PHP5 application or service.
Yes, this vulnerability can be exploited remotely by sending a specially crafted HTTP response to the affected application or service.
No, only versions of PHP5 prior to 5.4.45-0+deb7u13 are affected. It is recommended to upgrade to the latest version to mitigate the vulnerability.
There is no known public exploit for this vulnerability at the time of writing. However, it is still important to apply the recommended fix to protect against potential attacks.
You can find more information about this vulnerability in the Debian LTS security advisories and the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
