What’s Vulnerable › Vulnerabilities

CVE-2015-4643

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 15.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-05-16 · updated 2026-06-17
• Weakness: CWE-119

Description

Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.

Affected products

• Debian Linux: 7.0, 8.0
• Oracle Corporation Oracle Linux: 6, 7-0
• PHP: before 5.4.42; from 5.5.0 before 5.5.26; from 5.6.0 before 5.6.10 — fixed in 5.4.42, 5.5.26, 5.6.10
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Server Aus: 6.6, 7.3, 7.4, 7.6
• RedHat Enterprise Linux Server Eus: 6.6, 7.1, 7.2, 7.3, 7.4, 7.5 (+1)
• RedHat Enterprise Linux Server Tus: 6.6, 7.3, 7.6
• RedHat Enterprise Linux Workstation: 6.0, 7.0

How to fix

Upgrade to a fixed version: PHP 5.4.42, 5.5.26, 5.6.10. Check the vendor advisory for mitigations.

References

• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0765623d6991b62ffcd93ddb6be8a5203a2fa7e2
• http://openwall.com/lists/oss-security/2015/06/18/6
• http://php.net/ChangeLog-5.php
• http://rhn.redhat.com/errata/RHSA-2015-1135.html
• http://rhn.redhat.com/errata/RHSA-2015-1186.html
• http://rhn.redhat.com/errata/RHSA-2015-1187.html
• http://rhn.redhat.com/errata/RHSA-2015-1218.html
• http://www.debian.org/security/2015/dsa-3344
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
• http://www.securityfocus.com/bid/75291
• http://www.securitytracker.com/id/1032709
• https://bugs.php.net/bug.php?id=69545

Get alerted when CVE-2015-4643 or the next vulnerability affects your stack