CVE-2015-4602
published 2016-05-16CVE-2015-4602: The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote…
PriorityP350critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
10.67%
95.3th percentile
The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| php | php | <= 5.4.39 | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rwv3-9h8q-wffg: The __PHP_Incomplete_Class function in ext/standard/incomplete_class
ghsa_unreviewed·2022-05-14
CVE-2015-4602 [CRITICAL] GHSA-rwv3-9h8q-wffg: The __PHP_Incomplete_Class function in ext/standard/incomplete_class
The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
OSV
php5 vulnerabilities
osv·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] php5 vulnerabilities
php5 vulnerabilities
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015-4022,
CVE-2015-4643)
Shusheng Liu discovered that PHP inc
OSV
CVE-2015-4602: The __PHP_Incomplete_Class function in ext/standard/incomplete_class
osv·2015-06-23·CVSS 9.8
CVE-2015-4602 [CRITICAL] CVE-2015-4602: The __PHP_Incomplete_Class function in ext/standard/incomplete_class
The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2015-07-06·CVSS 6.5
CVE-2015-3411 [MEDIUM] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL
bytes in file paths. A remote attacker could possibly use this issue to
bypass intended restrictions and create or obtain access to sensitive
files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,
CVE-2015-4598)
Emmanuel Law discovered that the PHP phar extension incorrectly handled
filenames starting with a NULL byte. A remote attacker could use this issue
with a crafted tar archive to cause a denial of service. (CVE-2015-4021)
Max Spelsberg discovered that PHP incorrectly handled the LIST command
when connecting to remote FTP servers. A malicious FTP server could
possibly use this issue to execute arbitrary code. (CVE-2015
Red Hat
php: Incomplete Class unserialization type confusion
vendor_redhat·2015-03-20·CVSS 9.8
CVE-2015-4602 [CRITICAL] CWE-843 php: Incomplete Class unserialization type confusion
php: Incomplete Class unserialization type confusion
The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
Package: php (Red Hat Enterprise Linux 5) - Will not fix
Package: php53 (Red Hat Enterprise Linux 5) - Will not fix
Package: php54-php (Red Hat Software Collections) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-4602 php: Incomplete Class unserialization type confusion
bugzilla·2015-06-17·CVSS 9.8
CVE-2015-4602 [CRITICAL] CVE-2015-4602 php: Incomplete Class unserialization type confusion
CVE-2015-4602 php: Incomplete Class unserialization type confusion
A type confusion issue was found in the way PHP performed unserialization of incomplete class. If a specially crafted input is unserialized, it could lead to information leak and possibly code execution.
The issue was reported upstream in:
https://bugs.php.net/bug.php?id=69152#1426863482
and was corrected in:
http://git.php.net/?p=php-src.git;a=commitdiff;h=fb83c76deec58f1fab17c350f04c9f042e5977d1
See also bug 1222538 comment 7.
Discussion:
This issue was already corrected in Red Hat Software Collections php54 collection in Red Hat Software Collections 2.0, when php54-php component was updated to the fixed upstream version 5.4.40:
https://rhn.redhat.com/errata/RHSA-2015-1066.html
---
This issue has been addressed
Bugzilla
CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 php: type confusion issue in unserialize() with various SOAP methods
bugzilla·2015-05-18·CVSS 9.8
CVE-2015-4599 [CRITICAL] CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 php: type confusion issue in unserialize() with various SOAP methods
CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 php: type confusion issue in unserialize() with various SOAP methods
PHP versions 5.4.40, 5.5.24, and 5.6.8 provide a fix for type confusion vulnerability in unserialize() function used on a various SOAP methods.
Copy-paste description of the issue from the upstream bug:
"""
PHP_METHOD(SoapFault, __toString)
{
...
faultcode = zend_read_property(soap_fault_class_entry, this_ptr, "faultcode", sizeof("faultcode")-1, 1 TSRMLS_CC);
faultstring = zend_read_property(soap_fault_class_entry, this_ptr, "faultstring", sizeof("faultstring")-1, 1 TSRMLS_CC);
file = zend_read_property(soap_fault_class_entry, this_ptr, "file", sizeof("file")-1, 1 TSRMLS_CC);
line = zend_read_property(soap_fault_class_entry, this_ptr, "line", sizeof("line")-1, 1 TSRMLS_CC);
...
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=fb83c76deec58f1fab17c350f04c9f042e5977d1http://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1186.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1187.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://www.openwall.com/lists/oss-security/2015/06/16/12http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/75249http://www.securitytracker.com/id/1032709https://bugs.php.net/bug.php?id=69152http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=fb83c76deec58f1fab17c350f04c9f042e5977d1http://php.net/ChangeLog-5.phphttp://rhn.redhat.com/errata/RHSA-2015-1135.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1186.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1187.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1218.htmlhttp://www.openwall.com/lists/oss-security/2015/06/16/12http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/75249http://www.securitytracker.com/id/1032709https://bugs.php.net/bug.php?id=69152
2016-05-16
Published