CVE-2015-5589

Critical

Published: 16/05/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The phar_convert_to_other function in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not validate a file pointer before a close operation, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted TAR archive mishandled in a Phar::convertToData call.

Risk Assessment

An attacker can exploit this vulnerability to trigger a segmentation fault, leading to service unavailability. This may affect application stability and system availability.

Recommendation

It is recommended to update PHP to the latest version to mitigate this vulnerability. Additionally, conducting a code audit to identify and fix similar issues is advisable.

Original NVD description (English source)

The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not validate a file pointer before a close operation, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted TAR archive that is mishandled in a Phar::convertToData call.