CVE-2015-8617
CriticalSummary
CVE-2015-8617 describes a format string vulnerability in the zend_throw_or_error function in PHP 7.x before version 7.0.1. This allows remote attackers to execute arbitrary code via format string specifiers in a string misused as a class name, leading to incorrect error handling.
Risk Assessment
This vulnerability could lead to the execution of malicious code on the server, posing a serious threat to application security and user data. Attackers may exploit this vulnerability to gain control over the system.
Recommendation
It is recommended to upgrade PHP to version 7.0.1 or later to mitigate this vulnerability. Additionally, conducting a code audit to identify and fix potential misuse of class names is advisable.
Other vulnerabilities in PHP 7.x before 7.0.1
See all- CVE-2016-1904High
Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long string to the php_escape_shell_cmd or php_escape_shell_arg function, leading to a heap-based buffer overflow.
- CVE-2015-8616High
A use-after-free vulnerability in the Collator::sortWithSortKeys function in PHP 7.x before version 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.
- CVE-2015-6527High
The php_str_replace_in_subject function in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function.
- CVE-2016-9936Critical
The unserialize implementation in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data.
- CVE-2016-3132Critical
A double free vulnerability in the SplDoublyLinkedList::offsetSet function in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.
- CVE-2015-8880Critical
A double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to trigger an error, potentially leading to unspecified impact.
Original NVD description (English source)
Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.