PHP PHAR 'phar_tar_process_metadata()' Function Heap Memory Corruption Vulnerability

Bugtraq ID:	74703
Class:	Unknown
CVE:	CVE-2015-3307
Remote:	Yes
Local:	No
Published:	May 18 2015 12:00AM
Updated:	Jul 05 2016 09:28PM
Credit:	PHP
Vulnerable:	Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 CentOS CentOS 6
Not Vulnerable:

PHP PHAR 'phar_tar_process_metadata()' Function Heap Memory Corruption Vulnerability

PHP is prone to a heap-memory-corruption vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.

PHP PHAR 'phar_tar_process_metadata()' Function Heap Memory Corruption Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP PHAR 'phar_tar_process_metadata()' Function Heap Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.