CVE-2015-4644 — NULL Pointer Dereference in PHP

CWE-476 — NULL Pointer Dereference8 documents6 sources
Severity
7.5HIGHNVD
OSV6.5OSV5.0
EPSS
9.9%
top 6.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Php5PHPRedhat Enterprise Linux
Timeline
PublishedMay 16
Latest updateMay 14

Description

The php_pgsql_meta_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token extraction for table names, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1352.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶Ubuntuphp5/php5< 5.5.9+dfsg-1ubuntu4.11
▶NVDphp/php5.4.41+36

Also affects: Enterprise Linux 6.0, 7.0

🔴Vulnerability Details

3
GHSA
GHSA-xhh6-8vwc-47w8: The php_pgsql_meta_data function in pgsql↗2022-05-14
▶
OSV
php5 vulnerabilities↗2015-07-06
▶
OSV
CVE-2015-4644: The php_pgsql_meta_data function in pgsql↗2015-06-18
▶

📋Vendor Advisories

2
Ubuntu
PHP vulnerabilities↗2015-07-06
▶
Red Hat
php: NULL pointer dereference in php_pgsql_meta_data()↗2015-06-11
▶

💬Community

2
Bugzilla
CVE-2015-4644 CVE-2015-4643 php: various flaws [fedora-all]↗2015-06-23
▶
Bugzilla
CVE-2015-4644 php: NULL pointer dereference in php_pgsql_meta_data()↗2015-06-23
▶
CVE-2015-4644 — NULL Pointer Dereference in PHP | cvebase