// For flags

CVE-2015-4605

php: denial of service when processing a crafted file with Fileinfo

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.

La función mcopy en softmagic.c en file 5.x, tal como se utiliza en el componente Fileinfo en PHP en versiones anteriores a 5.4.40, 5.5.x en versiones anteriores a 5.5.24 y 5.6.x en versiones anteriores a 5.6.8, no restringe correctamente un cierto valor de desplazamiento, lo que permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código arbitrario a través de una cadena manipulada que no es manejada correctamente por una regla "secuencia de comandos de texto ejecutable de Python".

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2015-06-16 CVE Reserved
  • 2015-06-25 CVE Published
  • 2023-07-09 EPSS Updated
  • 2024-08-06 CVE Updated
  • 2024-08-06 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
<= 5.4.39
Search vendor "Php" for product "Php" and version " <= 5.4.39"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.0
Search vendor "Php" for product "Php" and version "5.5.0"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.1
Search vendor "Php" for product "Php" and version "5.5.1"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.2
Search vendor "Php" for product "Php" and version "5.5.2"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.3
Search vendor "Php" for product "Php" and version "5.5.3"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.4
Search vendor "Php" for product "Php" and version "5.5.4"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.5
Search vendor "Php" for product "Php" and version "5.5.5"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.6
Search vendor "Php" for product "Php" and version "5.5.6"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.7
Search vendor "Php" for product "Php" and version "5.5.7"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.8
Search vendor "Php" for product "Php" and version "5.5.8"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.9
Search vendor "Php" for product "Php" and version "5.5.9"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.10
Search vendor "Php" for product "Php" and version "5.5.10"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.11
Search vendor "Php" for product "Php" and version "5.5.11"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.12
Search vendor "Php" for product "Php" and version "5.5.12"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.13
Search vendor "Php" for product "Php" and version "5.5.13"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.14
Search vendor "Php" for product "Php" and version "5.5.14"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.15
Search vendor "Php" for product "Php" and version "5.5.15"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.16
Search vendor "Php" for product "Php" and version "5.5.16"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.17
Search vendor "Php" for product "Php" and version "5.5.17"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.18
Search vendor "Php" for product "Php" and version "5.5.18"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.19
Search vendor "Php" for product "Php" and version "5.5.19"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.20
Search vendor "Php" for product "Php" and version "5.5.20"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.21
Search vendor "Php" for product "Php" and version "5.5.21"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.22
Search vendor "Php" for product "Php" and version "5.5.22"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.5.23
Search vendor "Php" for product "Php" and version "5.5.23"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.6.0
Search vendor "Php" for product "Php" and version "5.6.0"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.6.1
Search vendor "Php" for product "Php" and version "5.6.1"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.6.2
Search vendor "Php" for product "Php" and version "5.6.2"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.6.3
Search vendor "Php" for product "Php" and version "5.6.3"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.6.4
Search vendor "Php" for product "Php" and version "5.6.4"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.6.5
Search vendor "Php" for product "Php" and version "5.6.5"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.6.6
Search vendor "Php" for product "Php" and version "5.6.6"
-
Affected
Php
Search vendor "Php"
Php
Search vendor "Php" for product "Php"
5.6.7
Search vendor "Php" for product "Php" and version "5.6.7"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Desktop
Search vendor "Redhat" for product "Enterprise Linux Desktop"
7.0
Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "7.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Hpc Node
Search vendor "Redhat" for product "Enterprise Linux Hpc Node"
7.0
Search vendor "Redhat" for product "Enterprise Linux Hpc Node" and version "7.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Hpc Node Eus
Search vendor "Redhat" for product "Enterprise Linux Hpc Node Eus"
7.1
Search vendor "Redhat" for product "Enterprise Linux Hpc Node Eus" and version "7.1"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Server
Search vendor "Redhat" for product "Enterprise Linux Server"
7.0
Search vendor "Redhat" for product "Enterprise Linux Server" and version "7.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Server Eus
Search vendor "Redhat" for product "Enterprise Linux Server Eus"
7.1
Search vendor "Redhat" for product "Enterprise Linux Server Eus" and version "7.1"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux Workstation
Search vendor "Redhat" for product "Enterprise Linux Workstation"
7.0
Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "7.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
6.0
Search vendor "Redhat" for product "Enterprise Linux" and version "6.0"
-
Affected
Redhat
Search vendor "Redhat"
Enterprise Linux
Search vendor "Redhat" for product "Enterprise Linux"
7.0
Search vendor "Redhat" for product "Enterprise Linux" and version "7.0"
-
Affected