CVE-2015-4643

Critical

Published: 16/05/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Heap-based buffer overflow in the ftp_genlist function in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command.

Risk Assessment

This vulnerability can lead to remote code execution, posing a serious security threat to systems running vulnerable versions of PHP.

Recommendation

It is recommended to upgrade PHP to the latest version to mitigate this vulnerability and any other known security issues.

Original NVD description (English source)

Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.