Bug 1338893 (CVE-2015-8878) - CVE-2015-8878 php: main/php_open_temporary_file.c does not ensure thread safety
Summary: CVE-2015-8878 php: main/php_open_temporary_file.c does not ensure thread safety
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2015-8878
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1338927
Blocks: 1338914
TreeView+ depends on / blocked
 
Reported: 2016-05-23 15:18 UTC by Andrej Nemec
Modified: 2019-09-29 13:49 UTC (History)
13 users (show)

Fixed In Version: php 5.5.28, php 5.6.12
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-06-01 13:53:57 UTC
Embargoed:

Attachments (Terms of Use)

Description Andrej Nemec 2016-05-23 15:18:36 UTC 
A vulnerability was found in php. main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.

Upstream bug:

https://bugs.php.net/bug.php?id=70002
Comment 1 Andrej Nemec 2016-05-23 16:35:47 UTC 
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1338927]
Comment 2 Tomas Hoger 2016-06-01 13:53:57 UTC 
Upstream identified that this problem was introduced via the following change:

https://bugs.php.net/bug.php?id=66048
http://git.php.net/?p=php-src.git;a=commitdiff;h=c117548ea9365adac00960fe5f43425b2955310d

in versions 5.5.26 and 5.6.10.  Issue was corrected by this patch:

http://git.php.net/?p=php-src.git;a=commitdiff;h=ce5c4500cd942ab85efa1e916ef00de860be9e6e

in versions 5.5.28 and 5.6.12.  No Red Hat product included affected versions.
Note You need to log in before you can comment on or make changes to this bug.