An invalid write vulnerability causing segmentation fault in phar on filename with \0 inside its name was found. Vulnerable code (phar_analyze_path): if (!(realpath = expand_filepath(filename, NULL))) { efree(filename); return FAILURE; } #ifdef PHP_WIN32 phar_unixify_path_separators(realpath, strlen(realpath)); #endif slash = strstr(realpath, filename); if (slash) { slash += ((ext - fname) + ext_len); *slash = '\0'; } If fname and thus filename contain \0's, realpath would not contain those parts and thus slash would point past the end of the realpath buffer. To exploit this, application has to allow attacker to create phar files with arbitrary filenames. Upstream bug: https://bugs.php.net/bug.php?id=71860 Upstream patch: https://gist.github.com/smalyshev/80b5c2909832872f2ba2 https://git.php.net/?p=php-src.git;a=commit;h=1e9b175204e3286d64dfd6c9f09151c31b5e099a
Created php tracking bugs for this issue: Affects: fedora-all [bug 1323111]
php-5.6.20-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
php-5.6.20-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html