cve/2015/CVE-2015-2301.md

CVE-2015-2301

Description

Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.

POC

Reference

• http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Github

• https://github.com/ARPSyndicate/cvemon