CVE-2015-2331

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 27.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2015-03-30 · updated 2026-06-17
Weakness: CWE-189

Description

Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.

Affected products

Debian Linux: 7.0
Fedoraproject Fedora: 22
NIH Libzip: through 0.11.2
Opensuse: 13.1, 13.2
PHP: through 5.4.38; 5.5.0, 5.5.0-alpha1, 5.5.0-alpha2, 5.5.0-alpha3, 5.5.0-alpha4, 5.5.0-alpha5 (+44)

References

http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5
http://hg.nih.at/libzip/rev/9f11d54f692e
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154266.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154276.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154666.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155299.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155622.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153983.html
http://lists.opensuse.org/opensuse-updates/2015-03/msg00083.html
http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html
http://marc.info/?l=bugtraq&m=143403519711434&w=2

Get alerted when CVE-2015-2331 or the next vulnerability affects your stack