CVE-2015-4598

HIGH

Description

PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as demonstrated by a filename\0.html attack that bypasses an intended configuration in which client users may write to only .html files.

ID	Name	Product	Family	Severity
124997	EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1544)	Nessus	Huawei Local Security Checks	critical
98802	PHP 5.6.x < 5.6.10 Multiple Vulnerabilities	Web Application Scanning	Component Vulnerability	critical
119968	SUSE SLES12 Security Update : php5 (SUSE-SU-2015:1253-1)	Nessus	SuSE Local Security Checks	critical
106495	pfSense < 2.2.3 Multiple Vulnerabilities (SA-15_07) (Logjam)	Nessus	Firewalls	critical
93915	F5 Networks BIG-IP : PHP vulnerability (K17049)	Nessus	F5 Networks Local Security Checks	high
93161	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	critical
85808	Debian DLA-307-1 : php5 security update	Nessus	Debian Local Security Checks	critical
85664	Debian DSA-3344-1 : php5 - security update	Nessus	Debian Local Security Checks	critical
84897	SUSE SLES11 Security Update : PHP (SUSE-SU-2015:1265-1)	Nessus	SuSE Local Security Checks	critical
84661	Scientific Linux Security Update : php on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
84660	RHEL 6 : php (RHSA-2015:1218)	Nessus	Red Hat Local Security Checks	critical
84659	Oracle Linux 6 : php (ELSA-2015-1218)	Nessus	Oracle Linux Local Security Checks	critical
84648	CentOS 6 : php (CESA-2015:1218)	Nessus	CentOS Local Security Checks	critical
84563	Ubuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : php5 vulnerabilities (USN-2658-1)	Nessus	Ubuntu Local Security Checks	critical
84557	openSUSE Security Update : php5 (openSUSE-2015-471)	Nessus	SuSE Local Security Checks	critical
84394	Scientific Linux Security Update : php on SL7.x x86_64	Nessus	Scientific Linux Local Security Checks	critical
84364	PHP 5.6.x < 5.6.10 Multiple Vulnerabilities	Nessus	CGI abuses	critical
84363	PHP 5.5.x < 5.5.26 Multiple Vulnerabilities	Nessus	CGI abuses	critical
84362	PHP 5.4.x < 5.4.42 Multiple Vulnerabilities	Nessus	CGI abuses	critical
84355	RHEL 7 : php (RHSA-2015:1135)	Nessus	Red Hat Local Security Checks	critical
84351	Oracle Linux 7 : php (ELSA-2015-1135)	Nessus	Oracle Linux Local Security Checks	critical
84345	CentOS 7 : php (CESA-2015:1135)	Nessus	CentOS Local Security Checks	critical
8787	PHP 5.5.x < 5.5.26 / 5.6.x < 5.6.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high

CVE-2015-4598

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0