Memory Corruption Vulnerability in PHP's phar_parse_tarfile Function

CVE-2015-4021 · MEDIUM Severity

AV:N/AC:L/AU:N/C:N/I:N/A:P

The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.

Learn more about our Web Application Penetration Testing UK.