Vulnerability in php5 - security update (CVE-2015-8865)
Summary
DLA-499-1: php5 - security update. Affects php5 versions < 5.4.45-0+deb7u3. Fixed in 5.4.45-0+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php5 is a popular open-source scripting language used for web development. It provides a wide range of functionality and is widely used in various applications. However, a vulnerability has been discovered in php5 that could potentially allow context-dependent attackers to cause a denial of service or execute arbitrary code. This vulnerability exists in versions before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5.
Vulnerability Detail
The vulnerability, identified as CVE-2015-8865, is caused by the mishandling of continuation-level jumps in the file_check_mem function in funcs.c. This can lead to a buffer overflow and application crash, or potentially allow an attacker to execute arbitrary code by exploiting a crafted magic file. This vulnerability poses a significant risk to applications using php5, as it can be exploited remotely by an attacker.
How To Fix
Minimum fixed version
5.4.45-0+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update provided by the php5 package maintainers to address the issue effectively.
Conclusion
The vulnerability in php5 (CVE-2015-8865) poses a significant risk to applications using this scripting language. It is crucial to update php5 to version 5.4.45-0+deb7u3 or later to mitigate the risk of exploitation. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
This vulnerability can lead to a denial of service (application crash) or potentially allow an attacker to execute arbitrary code on the affected system.
Yes, this vulnerability can be exploited remotely by an attacker.
No, there is no known workaround for this vulnerability. It is recommended to apply the provided security update.
Versions before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 are affected.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your php5 installation is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
