What’s Vulnerable › Vulnerabilities

CVE-2015-3307

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2015-06-09 · updated 2026-06-17
• Weakness: CWE-119

Description

The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.

Affected products

• macOS: through 10.10.4
• PHP: through 5.4.39; 5.5.0, 5.5.0-alpha1, 5.5.0-alpha2, 5.5.0-alpha3, 5.5.0-alpha4, 5.5.0-alpha5 (+42)
• Red Hat Enterprise Linux: 6.0, 7.0
• RedHat Enterprise Linux Desktop: 7.0
• RedHat Enterprise Linux Hpc Node: 7.0
• RedHat Enterprise Linux Hpc Node Eus: 7.1
• RedHat Enterprise Linux Server: 7.0
• RedHat Enterprise Linux Server Eus: 7.1
• RedHat Enterprise Linux Workstation: 7.0

References

• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
• http://rhn.redhat.com/errata/RHSA-2015-1066.html
• http://rhn.redhat.com/errata/RHSA-2015-1135.html
• http://rhn.redhat.com/errata/RHSA-2015-1186.html
• http://rhn.redhat.com/errata/RHSA-2015-1187.html
• http://rhn.redhat.com/errata/RHSA-2015-1218.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
• http://www.securityfocus.com/bid/74703
• https://bugs.php.net/bug.php?id=69443
• https://bugzilla.redhat.com/show_bug.cgi?id=1223441
• https://support.apple.com/kb/HT205031
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Get alerted when CVE-2015-3307 or the next vulnerability affects your stack