CVE-2015-8617

Critical

Published: 19/01/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2015-8617 describes a format string vulnerability in the zend_throw_or_error function in PHP 7.x before version 7.0.1. This allows remote attackers to execute arbitrary code via format string specifiers in a string misused as a class name, leading to incorrect error handling.

Risk Assessment

This vulnerability could lead to the execution of malicious code on the server, posing a serious threat to application security and user data. Attackers may exploit this vulnerability to gain control over the system.

Recommendation

It is recommended to upgrade PHP to version 7.0.1 or later to mitigate this vulnerability. Additionally, conducting a code audit to identify and fix potential misuse of class names is advisable.

Original NVD description (English source)

Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.