CVE-2015-4024

2015-06-0918:59:00

CWE-399

[email protected]

web.nvd.nist.gov

115

cve-2015-4024

algorithmic complexity

vulnerability

php

denial of service

remote attackers

nvd

7.5 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.713 High

EPSS

Percentile

98.0%

JSON

Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.

CPENameOperatorVersion
redhat:enterprise_linuxredhat enterprise linuxeq7.0
redhat:enterprise_linuxredhat enterprise linuxeq6.0
apple:mac_os_xapple mac os xle10.10.4
php:phpphpeq5.5.0
php:phpphpeq5.6.0
php:phpphpeq5.6.5
php:phpphpeq5.5.19
php:phpphple5.4.40
php:phpphpeq5.5.1
php:phpphpeq5.5.5

CPE	Name	Operator	Version
redhat:enterprise_linux	redhat enterprise linux	eq	7.0
redhat:enterprise_linux	redhat enterprise linux	eq	6.0
apple:mac_os_x	apple mac os x	le	10.10.4
php:php	php	eq	5.5.0
php:php	php	eq	5.6.0
php:php	php	eq	5.6.5
php:php	php	eq	5.5.19
php:php	php	le	5.4.40
php:php	php	eq	5.5.1
php:php	php	eq	5.5.5