PHP CVE-2015-4642 OS Command Injection Vulnerability

Bugtraq ID:	75290
Class:	Input Validation Error
CVE:	CVE-2015-4642
Remote:	Yes
Local:	No
Published:	Jun 18 2015 12:00AM
Updated:	Jul 06 2016 12:14PM
Credit:	[email protected]
Vulnerable:	Slackware Linux x86_64 -current Slackware Linux -current PHP PHP 5.4.3 PHP PHP 5.4.2 PHP PHP 5.4.1
Not Vulnerable:

PHP CVE-2015-4642 OS Command Injection Vulnerability

PHP is prone to an OS command-injection vulnerability because it fails to properly sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary OS commands in context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

PHP CVE-2015-4642 OS Command Injection Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

PHP CVE-2015-4642 OS Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Slackware Linux -current

• Slackware php-5.6.11-i586-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/ph p-5.6.11-i586-1.txz

Slackware Linux 14.1 x86_64

• Slackware php-5.4.43-x86_64-1_slack14.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/package s/php-5.4.43-x86_64-1_slack14.1.txz

Slackware Linux x86_64 -current

• Slackware php-5.6.11-x86_64-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ n/php-5.6.11-x86_64-1.txz

Slackware Linux 14.0 x86_64

• Slackware php-5.4.43-x86_64-1_slack14.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/package s/php-5.4.43-x86_64-1_slack14.0.txz

PHP CVE-2015-4642 OS Command Injection Vulnerability

References:

• PHP Homepage (PHP)