CVE-2015-8865 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.3 HIGH	LOCAL	LOW	LOW	CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 91%

Affected Products (NVD)

Vendor	Product	Version
php	php	𝑥 ≤ 5.5.33
php	php	5.6.0:alpha1
php	php	5.6.0:alpha2
php	php	5.6.0:alpha3
php	php	5.6.0:alpha4
php	php	5.6.0:alpha5
php	php	5.6.0:beta1
php	php	5.6.0:beta2
php	php	5.6.0:beta3
php	php	5.6.0:beta4
php	php	5.6.1
php	php	5.6.2
php	php	5.6.3
php	php	5.6.4
php	php	5.6.5
php	php	5.6.6
php	php	5.6.7
php	php	5.6.8
php	php	5.6.9
php	php	5.6.10
php	php	5.6.11
php	php	5.6.12
php	php	5.6.13
php	php	5.6.14
php	php	5.6.15
php	php	5.6.16
php	php	5.6.17
php	php	5.6.18
php	php	5.6.19
php	php	7.0.0
php	php	7.0.1
php	php	7.0.2
php	php	7.0.3
php	php	7.0.4
apple	mac_os_x	𝑥 ≤ 10.11.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

file

bookworm	1:5.44-3 fixed
bullseye	1:5.39-3+deb11u1 fixed
bullseye (security)	1:5.39-3+deb11u1 fixed
sid	1:5.45-3 fixed
trixie	1:5.45-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

file

artful	not-affected
bionic	not-affected
precise	ignored
trusty	Fixed 1:5.14-2ubuntu3.4 released
wily	ignored
xenial	not-affected
yakkety	not-affected
zesty	not-affected

php5

artful	dne
bionic	dne
precise	Fixed 5.3.10-1ubuntu3.22 released
trusty	Fixed 5.5.9+dfsg-1ubuntu4.16 released
wily	Fixed 5.6.11+dfsg-1ubuntu3.2 released
xenial	dne
yakkety	dne
zesty	dne

php7.0

artful	dne
bionic	dne
precise	dne
trusty	dne
wily	dne
xenial	Fixed 7.0.4-7ubuntu2.1 released
yakkety	not-affected
zesty	not-affected

Amazon Linux Releases

Amazon Package

Release

php55

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-bcmath

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-cli

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-common

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-dba

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-debuginfo

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-devel

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-embedded

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-enchant

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-fpm

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-gd

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-gmp

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-imap

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-intl

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-ldap

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-mbstring

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-mcrypt

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-mssql

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-mysqlnd

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-odbc

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-opcache

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-pdo

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-pgsql

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-process

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-pspell

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-recode

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-snmp

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-soap

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-tidy

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-xml

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php55-xmlrpc

Amazon Linux 1

0:5.5.35-1.114.amzn1

fixed

php56

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-bcmath

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-cli

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-common

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-dba

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-dbg

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-debuginfo

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-devel

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-embedded

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-enchant

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-fpm

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-gd

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-gmp

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-imap

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-intl

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-ldap

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-mbstring

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-mcrypt

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-mssql

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-mysqlnd

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-odbc

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-opcache

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-pdo

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-pgsql

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-process

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-pspell

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-recode

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-snmp

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-soap

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-tidy

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-xml

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

php56-xmlrpc

Amazon Linux 1

0:5.6.21-1.124.amzn1

fixed

Known Exploits!

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

http://bugs.gw.com/view.php?id=522

http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=fe13566c93f118a15a96320a546c7878fd0cfc5e

http://lists.apple.com/archives/security-announce/2016/May/msg00004.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html

http://rhn.redhat.com/errata/RHSA-2016-2750.html

http://www.debian.org/security/2016/dsa-3560

http://www.openwall.com/lists/oss-security/2016/04/24/1

http://www.php.net/ChangeLog-5.php

http://www.php.net/ChangeLog-7.php

http://www.securityfocus.com/bid/85802

http://www.ubuntu.com/usn/USN-2952-1

http://www.ubuntu.com/usn/USN-2952-2

https://bugs.php.net/bug.php?id=71527

https://github.com/file/file/commit/6713ca45e7757297381f4b4cdb9cf5e624a9ad36

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

https://security.gentoo.org/glsa/201611-22

https://security.gentoo.org/glsa/201701-42

https://support.apple.com/HT206567

https://usn.ubuntu.com/3686-1/

https://usn.ubuntu.com/3686-2/

http://bugs.gw.com/view.php?id=522

http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=fe13566c93f118a15a96320a546c7878fd0cfc5e

http://lists.apple.com/archives/security-announce/2016/May/msg00004.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html

http://rhn.redhat.com/errata/RHSA-2016-2750.html

http://www.debian.org/security/2016/dsa-3560

http://www.openwall.com/lists/oss-security/2016/04/24/1

http://www.php.net/ChangeLog-5.php

http://www.php.net/ChangeLog-7.php

http://www.securityfocus.com/bid/85802

http://www.ubuntu.com/usn/USN-2952-1

http://www.ubuntu.com/usn/USN-2952-2

https://bugs.php.net/bug.php?id=71527

https://github.com/file/file/commit/6713ca45e7757297381f4b4cdb9cf5e624a9ad36

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731

https://security.gentoo.org/glsa/201611-22

https://security.gentoo.org/glsa/201701-42

https://support.apple.com/HT206567

https://usn.ubuntu.com/3686-1/

https://usn.ubuntu.com/3686-2/