CVE-2015-3412
published 2016-05-16CVE-2015-3412: PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read…
PriorityP335medium5.3CVSS 3.0
AVNACLPRNUINSUCLINAN
EPSS
4.09%
89.6th percentile
PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| php | php | <= 5.4.39 | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv6.5MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-25q8-485x-mwx9: PHP before 5
ghsa_unreviewed·2022-05-14
CVE-2015-3412 [MEDIUM] CWE-200 GHSA-25q8-485x-mwx9: PHP before 5
PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.
OSV
php5 vulnerabilities
osv·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] php5 vulnerabilities
php5 vulnerabilities
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015-4022,
CVE-2015-4643)
Shusheng Liu discovered that PHP inc
OSV
CVE-2015-3412: PHP before 5
osv·2015-06-23·CVSS 5.3
CVE-2015-3412 [MEDIUM] CVE-2015-3412: PHP before 5
PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015
Red Hat
php: missing null byte checks for paths in various PHP extensions
vendor_redhat·2015-04-16·CVSS 5.3
CVE-2015-3412 [MEDIUM] CWE-626 php: missing null byte checks for paths in various PHP extensions
php: missing null byte checks for paths in various PHP extensions
PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.
It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions.
Package: php (Red Hat Enterpr
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-3412 php: missing null byte checks for paths in various PHP extensions
bugzilla·2015-06-17·CVSS 6.5
CVE-2015-3412 [MEDIUM] CVE-2015-3412 php: missing null byte checks for paths in various PHP extensions
CVE-2015-3412 php: missing null byte checks for paths in various PHP extensions
PHP versions 5.4.40, 5.5.24, and 5.6.8 provide fixes for multiple PHP extensions which did not check for NULL byte in a file name or path argument for certain functions, which could lead to bypass of intended access restrictions.
Upstream fix:
http://git.php.net/?p=php-src.git;a=commitdiff;h=52b93f0cfd3cba7ff98cc5198df6ca4f23865f80
The above commit also corrects problems from the following upstream bug report:
https://bugs.php.net/bug.php?id=69353
See bug 1213407 comment 5 for more details. It was decided to assign separate CVE ids for the issue described in the upstream bug report (CVE-2015-3411) and additional issues included in the upstream fix (CVE-2015-3412):
http://seclists.org/oss-sec/2015/q2/727
Bugzilla
CVE-2015-4598 php: missing null byte checks for paths in DOM and GD extensions
bugzilla·2015-06-17·CVSS 6.5
CVE-2015-4598 [MEDIUM] CVE-2015-4598 php: missing null byte checks for paths in DOM and GD extensions
CVE-2015-4598 php: missing null byte checks for paths in DOM and GD extensions
It was discovered that DOMDocument's save() and saveHTMLFile(), and GD imagepsencodefont() function did not properly handle file names with NUL character. This could cause the functions to access unexpected files when their arguments come from untrusted source. These issues are related to fixes for CVE-2015-3411 / CVE-2015-3412 which cover different functions from these extensions - see bug 1213407 comment 5.
Upstream bug report:
https://bugs.php.net/bug.php?id=69719
Upstream fix:
http://git.php.net/?p=php-src.git;a=commitdiff;h=f7d7befae8bcc2db0093f8adaa9f72eeb7ad891e
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2015:1135 https://rhn.redhat.com/
Bugzilla
CVE-2015-3411 php: missing null byte checks for paths in various PHP extensions
bugzilla·2015-04-20·CVSS 5.0
CVE-2015-3411 [MEDIUM] CVE-2015-3411 php: missing null byte checks for paths in various PHP extensions
CVE-2015-3411 php: missing null byte checks for paths in various PHP extensions
PHP versions 5.4.40, 5.5.24, and 5.6.8 provide a fix for multiple PHP extensions which did not check for NULL byte in a path when processing/reading a file which might lead to a sensitive information disclosure.
Upstream fix:
http://git.php.net/?p=php-src.git;a=commitdiff;h=52b93f0cfd3cba7ff98cc5198df6ca4f23865f80
Upstream bug:
https://bugs.php.net/bug.php?id=69353
Discussion:
Created php tracking bugs for this issue:
Affects: fedora-all [bug 1213456]
---
php-5.6.8-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
---
php-5.6.8-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=4435b9142ff9813845d5c97ab29a5d637bedb257http://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1186.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1187.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/75250http://www.securitytracker.com/id/1032709https://bugs.php.net/bug.php?id=69353http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=4435b9142ff9813845d5c97ab29a5d637bedb257http://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1186.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1187.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/75250http://www.securitytracker.com/id/1032709https://bugs.php.net/bug.php?id=69353
2016-05-16
Published