CVE-2015-4605

CWE-20 — Improper Input Validation8 documents8 sources
Severity
7.5HIGH
EPSS
9.1%
top 7.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
PHP PHPRedhat Enterprise LinuxRedhat Enterprise Linux Desktop+5 more
Timeline
PublishedMay 16
Latest updateMay 14

Description

The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶Ubuntuphp5< 5.5.9+dfsg-1ubuntu4.9
▶NVDphp/php5.4.39+32

Also affects: Enterprise Linux 6.0, 7.0, 7.1

🔴Vulnerability Details

3
GHSA
GHSA-94g6-fh67-6qp6: The mcopy function in softmagic↗2022-05-14
▶
CVEList
CVE-2015-4605: The mcopy function in softmagic↗2016-05-16
▶
OSV
CVE-2015-4605: The mcopy function in softmagic↗2015-06-18
▶

📋Vendor Advisories

3
Ubuntu
PHP vulnerabilities↗2015-07-06
▶
Red Hat
php: denial of service when processing a crafted file with Fileinfo↗2015-04-16
▶
Debian
CVE-2015-4605: file - The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component...↗2015
▶

💬Community

1
Bugzilla
CVE-2015-4604 CVE-2015-4605 php: denial of service when processing a crafted file with Fileinfo↗2015-04-20
▶
CVE-2015-4605 (HIGH CVSS 7.5) | The mcopy function in softmagic.c i | cvebase.io