CVE-2015-3411 Information
Share on:Description
PHP before 5.4.40 5.5.x before 5.5.24 and 5.6.x before 5.6.8 does not ensure that pathnames lack 00 sequences which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method (2) the xmlwriter_open_uri function (3) the finfo_file function or (4) the hash_hmac_file function as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Reference
http://git.php.net/?p=php-src.git;a=commit;h=4435b9142ff9813845d5c97ab29a5d637bedb257 http://php.net/ChangeLog-5.php http://rhn.redhat.com/errata/RHSA-2015-1135.html http://rhn.redhat.com/errata/RHSA-2015-1186.html http://rhn.redhat.com/errata/RHSA-2015-1187.html http://rhn.redhat.com/errata/RHSA-2015-1218.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html http://www.securityfocus.com/bid/75255 http://www.securitytracker.com/id/1032709 https://bugs.php.net/bug.php?id=69353
Attack Complexity
LOW
Privileges Required
NONE
User Interaction Required
NONE
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
LOW
Availability Impact
LOW
Base Score
NONE
Base Severity
6.5