CVE-2015-7803

Published Dec 11, 2015

Last updated a year ago

Overview

Description
The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a .phar file with a crafted TAR archive entry in which the Link indicator references a file that does not exist.
Source
secalert@redhat.com
NVD status
Modified

Risk scores

CVSS 2.0

Type
Primary
Base score
6.8
Impact score
6.4
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov
NVD-CWE-Other

Social media

Hype score
Not currently trending

Evaluator

Comment
<a href="https://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> <a href="http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html">Per Advisory: The attack can lead to remote code execution
Impact
-
Solution
-

Configurations