Description

Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (uninitialized pointer dereference and application crash) by including the / filename in a .zip PHAR archive.

Remediation

References

CVE-2015-7804

Related Vulnerabilities

Apache error log escape sequence injection vulnerability

WordPress Plugin Page and Post Clone Information Disclosure (1.1)

Oracle Database Server CVE-2006-5333 Vulnerability (CVE-2006-5333)

WordPress Plugin PowerPack Addons for Elementor Multiple Cross-Site Scripting Vulnerabilities (2.3.1)

WordPress Plugin Backup and Staging by WP Time Capsule PHP Object Injection (1.21.9)

Severity

Medium

Classification

CVE-2015-7804

Tags

Missing Update Known Vulnerabilities