Unrated severityNVD Advisory· Published Jun 9, 2015· Updated May 6, 2026
CVE-2015-3329
CVE-2015-3329
Description
Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.
Affected products
67- cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*
- cpe:2.3:o:oracle:solaris:11.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 48 more
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: <=5.4.39
- cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*range: <=10.6.8
- cpe:2.3:o:apple:mac_os_x:10.9.5:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.10.0:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.10.1:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.10.2:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.10.3:*:*:*:*:*:*:*
- cpe:2.3:o:apple:mac_os_x:10.10.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
20- php.net/ChangeLog-5.phpnvdPatch
- bugs.php.net/bug.phpnvdExploitPatch
- lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlnvdMailing ListVendor Advisory
- lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlnvdMailing ListVendor Advisory
- rhn.redhat.com/errata/RHSA-2015-1135.htmlnvdThird Party Advisory
- rhn.redhat.com/errata/RHSA-2015-1187.htmlnvdThird Party Advisory
- www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlnvdThird Party Advisory
- www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlnvdThird Party Advisory
- support.apple.com/HT205267nvdThird Party Advisory
- support.apple.com/kb/HT205031nvdThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-05/msg00004.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-1066.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-1186.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-1218.htmlnvd
- www.debian.org/security/2015/dsa-3280nvd
- www.securityfocus.com/bid/74240nvd
- www.securitytracker.com/id/1032145nvd
- www.ubuntu.com/usn/USN-2572-1nvd
- security.gentoo.org/glsa/201606-10nvd
News mentions
0No linked articles in our index yet.