Use-after-free vulnerability in php5
Summary
DSA-3198-2: php5 - regression update. Affects php5 versions < 5.4.39-0+deb7u2. Fixed in 5.4.39-0+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a popular server-side scripting language used for web development. The php5 package is a specific version of PHP for Debian 7 (wheezy). It provides various features and functions for building dynamic websites and applications. However, a vulnerability has been discovered in the php5 package that can lead to a use-after-free condition in the phar extension.
Vulnerability Detail
The use-after-free vulnerability (CVE-2015-2301) in the phar extension of php5 allows an attacker to exploit a freed object in memory, potentially leading to arbitrary code execution or a denial of service. This vulnerability can be triggered by manipulating certain phar archives. Additionally, an integer overflow vulnerability (CVE-2015-2331) has been found in the processing of ZIP archives, which can also result in denial of service or arbitrary code execution.
How To Fix
Minimum fixed version
5.4.39-0+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for these vulnerabilities. The best course of action is to apply the available security update.
Conclusion
The php5 package in Debian 7 (wheezy) is vulnerable to a use-after-free vulnerability in the phar extension and an integer overflow vulnerability in the processing of ZIP archives. To address these vulnerabilities, it is crucial to upgrade to php5 version 5.4.39-0+deb7u1 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to various security issues, including crashes, code execution, or information disclosure.
By crafting a malicious phar archive and tricking a user or application into processing it, an attacker can trigger the use-after-free vulnerability and potentially execute arbitrary code or cause a denial of service.
An integer overflow vulnerability occurs when an arithmetic operation results in a value that exceeds the maximum representable value for the data type. This can lead to unexpected behavior, crashes, or even code execution.
Yes, these vulnerabilities can be exploited remotely if the affected PHP code is exposed to untrusted input from external sources.
There are no known public exploits available for these vulnerabilities at the time of this report. However, it is always recommended to apply security updates promptly to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
