CVE-2015-4644

The php_pgsql_meta_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token extraction for table names, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1352.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
redhatenterprise_linux
6.0
redhatenterprise_linux
7.0
phpphp
𝑥
≤ 5.4.41
phpphp
5.5.0
phpphp
5.5.1
phpphp
5.5.2
phpphp
5.5.3
phpphp
5.5.4
phpphp
5.5.5
phpphp
5.5.6
phpphp
5.5.7
phpphp
5.5.8
phpphp
5.5.9
phpphp
5.5.10
phpphp
5.5.11
phpphp
5.5.12
phpphp
5.5.13
phpphp
5.5.14
phpphp
5.5.15
phpphp
5.5.16
phpphp
5.5.17
phpphp
5.5.18
phpphp
5.5.19
phpphp
5.5.20
phpphp
5.5.21
phpphp
5.5.22
phpphp
5.5.23
phpphp
5.5.24
phpphp
5.5.25
phpphp
5.6.0
phpphp
5.6.1
phpphp
5.6.2
phpphp
5.6.3
phpphp
5.6.4
phpphp
5.6.5
phpphp
5.6.6
phpphp
5.6.7
phpphp
5.6.8
phpphp
5.6.9
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
php5
precise
Fixed 5.3.10-1ubuntu3.19
released
trusty
Fixed 5.5.9+dfsg-1ubuntu4.11
released
utopic
Fixed 5.5.12+dfsg-2ubuntu4.6
released
vivid
Fixed 5.6.4+dfsg-4ubuntu6.2
released
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
php54
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-bcmath
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-cli
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-common
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-dba
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-debuginfo
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-devel
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-embedded
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-enchant
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-fpm
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-gd
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-imap
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-intl
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-ldap
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-mbstring
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-mcrypt
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-mssql
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-mysql
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-mysqlnd
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-odbc
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-pdo
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-pgsql
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-process
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-pspell
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-recode
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-snmp
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-soap
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-tidy
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-xml
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php54-xmlrpc
Amazon Linux 1
0:5.4.42-1.71.amzn1
fixed
php55
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-bcmath
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-cli
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-common
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-dba
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-debuginfo
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-devel
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-embedded
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-enchant
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-fpm
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-gd
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-gmp
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-imap
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-intl
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-ldap
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-mbstring
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-mcrypt
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-mssql
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-mysqlnd
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-odbc
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-opcache
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-pdo
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-pgsql
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-process
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-pspell
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-recode
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-snmp
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-soap
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-tidy
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-xml
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php55-xmlrpc
Amazon Linux 1
0:5.5.26-1.103.amzn1
fixed
php56
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-bcmath
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-cli
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-common
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-dba
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-dbg
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-debuginfo
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-devel
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-embedded
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-enchant
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-fpm
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-gd
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-gmp
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-imap
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-intl
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-ldap
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-mbstring
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-mcrypt
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-mssql
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-mysqlnd
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-odbc
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-opcache
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-pdo
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-pgsql
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-process
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-pspell
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-recode
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-snmp
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-soap
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-tidy
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-xml
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
php56-xmlrpc
Amazon Linux 1
0:5.6.10-1.115.amzn1
fixed
References
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2cc4e69cc6d8dbc4b3568ad3dd583324a7c11d64
http://openwall.com/lists/oss-security/2015/06/18/6
http://php.net/ChangeLog-5.php
http://rhn.redhat.com/errata/RHSA-2015-1186.html
http://rhn.redhat.com/errata/RHSA-2015-1187.html
http://www.debian.org/security/2015/dsa-3344
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
http://www.securityfocus.com/bid/75292
http://www.securitytracker.com/id/1032709
https://bugs.php.net/bug.php?id=69667
https://security.gentoo.org/glsa/201606-10
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2cc4e69cc6d8dbc4b3568ad3dd583324a7c11d64
http://openwall.com/lists/oss-security/2015/06/18/6
http://php.net/ChangeLog-5.php
http://rhn.redhat.com/errata/RHSA-2015-1186.html
http://rhn.redhat.com/errata/RHSA-2015-1187.html
http://www.debian.org/security/2015/dsa-3344
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
http://www.securityfocus.com/bid/75292
http://www.securitytracker.com/id/1032709
https://bugs.php.net/bug.php?id=69667
https://security.gentoo.org/glsa/201606-10