CVE-2015-8865
Publication date 31 December 2015
Last updated 24 July 2024
Ubuntu priority
The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| file | 18.04 LTS bionic |
Not affected
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Fixed 1:5.14-2ubuntu3.4
|
|
| php5 | 18.04 LTS bionic | Not in release |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty |
Fixed 5.5.9+dfsg-1ubuntu4.16
|
|
| php7.0 | 18.04 LTS bionic | Not in release |
| 16.04 LTS xenial |
Fixed 7.0.4-7ubuntu2.1
|
|
| 14.04 LTS trusty | Not in release | |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.3 · High
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-3686-1
- file vulnerabilities
- 14 June 2018
- USN-2984-1
- PHP vulnerabilities
- 24 May 2016
- USN-3686-2
- file vulnerabilities
- 28 June 2018