CVE-2015-2783

medium · 5.8

ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.

5.8

CVSS

10.5%

EPSS (exploit prob.)

96th

EPSS percentile

2015-06-09

Published

AV:N/AC:M/Au:N/C:P/I:N/A:P

Weaknesses

CWE-119

Affected products

Vendor	Product	Affected versions
php	php	<= 5.4.39
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.1
php	php	5.5.2
php	php	5.5.3
php	php	5.5.4
php	php	5.5.5
php	php	5.5.6
php	php	5.5.7
php	php	5.5.8
php	php	5.5.9
php	php	5.5.10
php	php	5.5.11
php	php	5.5.12
php	php	5.5.13
php	php	5.5.14
php	php	5.5.18
php	php	5.5.19
php	php	5.5.20
php	php	5.5.21
php	php	5.5.22
php	php	5.5.23
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-2783