CVE-2015-4022
published 2015-06-09CVE-2015-4022: Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to…
PriorityP353high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
20.84%
97.3th percentile
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
Affected
66 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | <= 10.10.4 | — |
| apple | os_x_yosemite_v10.10.5_and_security_update_2015-006 | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| oracle | linux | — | — |
| oracle | linux | — | — |
| php | php | < 5.4.42 | 5.4.42 |
| php | php | <= 5.4.40 | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015
Red Hat
php: integer overflow in ftp_genlist() resulting in heap overflow (improved fix for CVE-2015-4022)
vendor_redhat·2015-06-11·CVSS 7.5
CVE-2015-4643 [HIGH] CWE-190 php: integer overflow in ftp_genlist() resulting in heap overflow (improved fix for CVE-2015-4022)
php: integer overflow in ftp_genlist() resulting in heap overflow (improved fix for CVE-2015-4022)
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.
Package: php (Red Hat Enterprise Linux 5) - Will not fix
Package: php53 (Red Hat Enterprise Linux 5) - Will not fix
Red Hat
php: integer overflow leading to heap overflow when reading FTP file listing
vendor_redhat·2015-05-14·CVSS 7.5
CVE-2015-4022 [HIGH] CWE-190 php: integer overflow leading to heap overflow when reading FTP file listing
php: integer overflow leading to heap overflow when reading FTP file listing
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
Package: php (Red Hat Enterprise Linux 5) - Will not fix
Package: php53 (Red Hat Enterprise Linux 5) - Will not fix
Apple
CVE-2015-4022: OS X Yosemite v10.10.5 and Security Update 2015-006
vendor_apple·CVSS 7.5
CVE-2015-4022 [HIGH] CVE-2015-4022: OS X Yosemite v10.10.5 and Security Update 2015-006
Apple Security Update: About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006
Product: OS X Yosemite v10.10.5 and Security Update 2015-006
CVE: CVE-2015-4022
Component: CVE-2015-4022
GHSA
GHSA-vgxm-5fpx-8gm6: Integer overflow in the ftp_genlist function in ext/ftp/ftp
ghsa_unreviewed·2022-05-14
CVE-2015-4022 [HIGH] GHSA-vgxm-5fpx-8gm6: Integer overflow in the ftp_genlist function in ext/ftp/ftp
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
GHSA
GHSA-phcc-83hq-g329: Integer overflow in the ftp_genlist function in ext/ftp/ftp
ghsa_unreviewed·2022-05-13·CVSS 7.5
CVE-2015-4643 [HIGH] CWE-119 GHSA-phcc-83hq-g329: Integer overflow in the ftp_genlist function in ext/ftp/ftp
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.
OSV
php5 vulnerabilities
osv·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] php5 vulnerabilities
php5 vulnerabilities
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015-4022,
CVE-2015-4643)
Shusheng Liu discovered that PHP inc
OSV
CVE-2015-4643: Integer overflow in the ftp_genlist function in ext/ftp/ftp
osv·2015-06-18·CVSS 7.5
CVE-2015-4643 [HIGH] CVE-2015-4643: Integer overflow in the ftp_genlist function in ext/ftp/ftp
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.
OSV
CVE-2015-4022: Integer overflow in the ftp_genlist function in ext/ftp/ftp
osv·2015-06-09·CVSS 7.5
CVE-2015-4022 [HIGH] CVE-2015-4022: Integer overflow in the ftp_genlist function in ext/ftp/ftp
Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.
No detection rules found.
No public exploits indexed.
Tenable
[R4] SecurityCenter 5.0.0.1 Affected by Third-party Library
blogs_tenable·2015-06-15
[R4] SecurityCenter 5.0.0.1 Affected by Third-party Library
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2015-4643 php: integer overflow in ftp_genlist() resulting in heap overflow (improved fix for CVE-2015-4022)
bugzilla·2015-06-23·CVSS 7.5
CVE-2015-4643 [HIGH] CVE-2015-4643 php: integer overflow in ftp_genlist() resulting in heap overflow (improved fix for CVE-2015-4022)
CVE-2015-4643 php: integer overflow in ftp_genlist() resulting in heap overflow (improved fix for CVE-2015-4022)
PHP versions 5.4.42, 5.5.26, and 5.6.10 provide improved fix for CVE-2015-4022:
Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow).
Upstream bug:
https://bugs.php.net/bug.php?id=69545#1431550655
Upstream fix:
http://git.php.net/?p=php-src.git;a=commitdiff;h=0765623d6991b62ffcd93ddb6be8a5203a2fa7e2
The #69545 bug was originally fixed in 5.4.41 / 5.5.25 / 5.6.9 and got CVE-2015-4022 (see bug 1223412), but the fix was found to be incomplete, as explained in the upstream bug.
Discussion:
Created php tracking bugs for this issue:
Affects: fedora-all [bug 1234942]
---
As noted in the description, this CVE was assigned to an incomplete
Bugzilla
CVE-2015-4021 CVE-2015-4025 CVE-2015-4026 php: various flaws [fedora-all]
bugzilla·2015-05-20·CVSS 5.0
CVE-2015-4021 [MEDIUM] CVE-2015-4021 CVE-2015-4025 CVE-2015-4026 php: various flaws [fedora-all]
CVE-2015-4021 CVE-2015-4025 CVE-2015-4026 php: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedo
Bugzilla
CVE-2015-4022 php: integer overflow leading to heap overflow when reading FTP file listing
bugzilla·2015-05-20·CVSS 7.5
CVE-2015-4022 [HIGH] CVE-2015-4022 php: integer overflow leading to heap overflow when reading FTP file listing
CVE-2015-4022 php: integer overflow leading to heap overflow when reading FTP file listing
The ftp_genlist() function of the ftp extension is prone to an integer overflow, which may result in remote code execution under certain circumstances.
Upstream report:
https://bugs.php.net/bug.php?id=69545
Upstream fix:
http://git.php.net/?p=php-src.git;a=commitdiff;h=ac2832935435556dc593784cd0087b5e576bbe4d
CVE request:
http://seclists.org/oss-sec/2015/q2/479
Discussion:
Created php tracking bugs for this issue:
Affects: fedora-all [bug 1223447]
---
php-5.6.9-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
---
php-5.6.9-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, ple
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/159031.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00002.htmlhttp://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1186.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1187.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1219.htmlhttp://www.debian.org/security/2015/dsa-3280http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/74902http://www.securitytracker.com/id/1032433https://bugs.php.net/bug.php?id=69545https://security.gentoo.org/glsa/201606-10https://support.apple.com/kb/HT205031http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/159031.htmlhttp://lists.opensuse.org/opensuse-updates/2015-06/msg00002.htmlhttp://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1186.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1187.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1219.htmlhttp://www.debian.org/security/2015/dsa-3280http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/74902http://www.securitytracker.com/id/1032433https://bugs.php.net/bug.php?id=69545https://security.gentoo.org/glsa/201606-10https://support.apple.com/kb/HT205031
2015-06-09
Published