Vulnerability CVE-2015-4644

Vulnerability Name:

CVE-2015-4644 (CCN-103927)

Assigned:

2015-06-18

Published:

2015-06-18

Updated:

2019-04-22

Summary:

The php_pgsql_meta_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token extraction for table names, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.
Note: this vulnerability exists because of an incomplete fix for CVE-2015-1352.

CWE-476: NULL Pointer Dereference

CVSS v3 Severity:

7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-Other

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2015-4644

Source: CONFIRM
Type: UNKNOWN
http://git.php.net/?p=php-src.git;a=commit;h=2cc4e69cc6d8dbc4b3568ad3dd583324a7c11d64

Source: MLIST
Type: UNKNOWN
[oss-security] 20150618 Re: PHP 5.6.10 / 5.5.26 / 5.4.42 CVE request

Source: CONFIRM
Type: UNKNOWN
http://php.net/ChangeLog-5.php

Source: REDHAT
Type: UNKNOWN
RHSA-2015:1186

Source: REDHAT
Type: UNKNOWN
RHSA-2015:1187

Source: CCN
Type: oss-security Mailing List, Thu, 18 Jun 2015 11:22:38 +0200
PHP 5.6.10 / 5.5.26 / 5.4.42 CVE request

Source: CCN
Type: oss-security Mailing List, Thu, 18 Jun 2015 08:21:49 -0400 (EDT)
Re: PHP 5.6.10 / 5.5.26 / 5.4.42 CVE request

Source: DEBIAN
Type: UNKNOWN
DSA-3344

Source: CCN
Type: IBM Security Bulletin T1024735 (SmartCloud Entry)
Vulnerabilities in Php affect IBM SmartCloud Entry (CVE-2015-4644 CVE-2016-5385)

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Source: CCN
Type: PHP Web Site
PHP

Source: BID
Type: UNKNOWN
75292

Source: CCN
Type: BID-75292
PHP CVE-2015-4644 Incomplete Fix Null Pointer Deference Denial of Service Vulnerability

Source: SECTRACK
Type: UNKNOWN
1032709

Source: CONFIRM
Type: UNKNOWN
https://bugs.php.net/bug.php?id=69667

Source: XF
Type: UNKNOWN
php-cve20154644-dos(103927)

Source: GENTOO
Type: UNKNOWN
GLSA-201606-10

Source: CCN
Type: IBM Security Bulletin 5098669
Multiple vulnerabilities in php affect IBM Flex System Manger (FSM)

Vulnerable Configuration:

Configuration 1:

cpe:/o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:php:php:*:*:*:*:*:*:*:* (Version <= 5.4.41)

OR cpe:/a:php:php:5.5.0:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.1:*:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.2:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.3:*:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.4:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.5:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.6:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.7:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.8:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.9:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.10:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.11:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.12:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.13:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.14:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.15:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.16:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.17:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.18:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.19:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.20:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.21:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.22:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.23:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.24:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.25:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.0:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.1:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.2:*:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.3:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.4:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.5:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.6:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.7:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.8:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.6.9:-:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:php:php:5.6.9:-:*:*:*:*:*:*

OR cpe:/a:php:php:5.4.41:*:*:*:*:*:*:*

OR cpe:/a:php:php:5.5.25:-:*:*:*:*:*:*

AND

cpe:/a:ibm:flex_system_manager:1.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:flex_system_manager:1.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:flex_system_manager:1.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:flex_system_manager:1.3.1:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20154644	V	CVE-2015-4644	2022-05-20
oval:org.opensuse.security:def:9680	P	Security update for libsndfile (Important)	2022-01-11
oval:org.opensuse.security:def:10438	P	Security update for java-1_8_0-ibm (Important) (in QA)	2022-01-04
oval:org.opensuse.security:def:9884	P	Security update for go1.17 (Moderate)	2021-12-23
oval:org.opensuse.security:def:33758	P	Security update for xorg-x11-server (Important)	2021-12-20
oval:org.opensuse.security:def:9634	P	Security update for log4j (Important)	2021-12-17
oval:org.opensuse.security:def:34609	P	Security update for mozilla-nss (Important)	2021-12-06
oval:org.opensuse.security:def:10371	P	Security update for the Linux Kernel (Important)	2021-12-02
oval:org.opensuse.security:def:9619	P	Security update for python-Pygments (Important)	2021-12-01
oval:org.opensuse.security:def:10368	P	Security update for ruby2.5 (Important)	2021-12-01
oval:org.opensuse.security:def:10175	P	Security update for webkit2gtk3 (Important)	2021-11-23
oval:org.opensuse.security:def:9612	P	Security update for MozillaFirefox (Important)	2021-11-10
oval:org.opensuse.security:def:9417	P	Security update for MozillaFirefox (Important)	2021-11-10
oval:org.opensuse.security:def:10169	P	Security update for Salt (Moderate)	2021-10-27
oval:org.opensuse.security:def:9604	P	Security update for dnsmasq (Moderate)	2021-10-27
oval:org.opensuse.security:def:10162	P	Security update for glibc (Moderate)	2021-10-12
oval:org.opensuse.security:def:10346	P	Security update for curl (Moderate)	2021-10-06
oval:org.opensuse.security:def:29423	P	Security update for openssl (Low)	2021-09-20
oval:org.opensuse.security:def:10153	P	Security update for openssl-1_0_0 (Low)	2021-09-09
oval:org.opensuse.security:def:33971	P	Security update for openssl-1_0_0 (Low)	2021-09-09
oval:org.opensuse.security:def:9395	P	Security update for libesmtp (Important)	2021-09-03
oval:org.opensuse.security:def:10147	P	Security update for xerces-c (Important)	2021-09-02
oval:org.opensuse.security:def:11120	P	Security update for libspf2 (Critical)	2021-08-25
oval:org.opensuse.security:def:10139	P	Security update for djvulibre (Important)	2021-08-20
oval:org.opensuse.security:def:9387	P	Security update for spice-vdagent (Moderate)	2021-08-20
oval:org.opensuse.security:def:13906	P	libgypsy0-0.9-6.22 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:13996	P	pam-1.1.8-14.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14243	P	libjbig2-2.0-12.13 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14062	P	xf86-video-intel-2.99.917.641_ge4ef6e9-12.3 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14267	P	libopus0-1.1-3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14174	P	java-1_7_0-openjdk-1.7.0.141-42.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14927	P	iputils-s20121221-2.17 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:13928	P	libmodplug1-0.8.8.4-13.63 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14044	P	sysvinit-tools-2.88+-96.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:13898	P	libfreebl3-3.21.1-46.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14254	P	libmicrohttpd10-0.9.30-5.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14081	P	apache-commons-daemon-1.0.15-6.10 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14905	P	gnome-shell-search-provider-nautilus-3.20.3-23.12.10 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:14199	P	libXpm4-3.5.11-5.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:9761	P	Security update for nodejs8 (Important)	2021-08-05
oval:org.opensuse.security:def:11098	P	Security update for claws-mail (Moderate)	2021-07-16
oval:org.opensuse.security:def:10296	P	Security update for go1.15 (Important)	2021-06-30
oval:org.opensuse.security:def:9544	P	Security update for ovmf (Important)	2021-06-25
oval:org.opensuse.security:def:10111	P	Security update for openexr (Important)	2021-06-24
oval:org.opensuse.security:def:9742	P	Security update for openexr (Important)	2021-06-24
oval:org.opensuse.security:def:33927	P	Security update for caribou (Important)	2021-06-10
oval:org.opensuse.security:def:9727	P	Security update for ucode-intel (Important)	2021-06-10
oval:org.opensuse.security:def:10277	P	Security update for spice-gtk (Moderate)	2021-06-10
oval:org.opensuse.security:def:9525	P	Security update for qemu (Important)	2021-06-09
oval:org.opensuse.security:def:16634	P	php5-devel-5.5.14-109.41.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16447	P	gstreamer-0_10-plugins-bad-devel-0.10.23-25.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16566	P	libpulse-devel-5.0-4.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:15880	P	php5-devel-5.5.14-39.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16654	P	slf4j-1.7.12-3.3.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16098	P	php5-devel-5.5.14-73.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16481	P	libXres-devel-1.0.7-3.53 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16623	P	net-snmp-devel-5.7.3-6.3.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16439	P	gimp-devel-2.8.18-9.3.26 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:16348	P	php5-devel-5.5.14-108.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:10086	P	Security update for dhcp (Important)	2021-06-02
oval:org.opensuse.security:def:10262	P	Security update for curl (Moderate)	2021-05-31
oval:org.opensuse.security:def:9708	P	Security update for lz4 (Important)	2021-05-19
oval:org.opensuse.security:def:9510	P	Security update for djvulibre (Important)	2021-05-19
oval:org.opensuse.security:def:33903	P	Security update for samba (Important)	2021-05-04
oval:org.opensuse.security:def:9695	P	Security update for xen (Important)	2021-04-30
oval:org.opensuse.security:def:9686	P	Security update for spamassassin (Important)	2021-04-13
oval:org.opensuse.security:def:9862	P	Security update for openssl-1_1 (Moderate)	2021-03-09
oval:org.opensuse.security:def:34649	P	Security update for the Linux Kernel (Important)	2021-03-09
oval:org.opensuse.security:def:9861	P	Security update for the Linux Kernel (Important)	2021-03-09
oval:org.opensuse.security:def:9463	P	Security update for openldap2 (Important)	2021-03-08
oval:org.opensuse.security:def:29480	P	Security update for openldap2 (Important)	2021-03-03
oval:org.opensuse.security:def:10215	P	Security update for python-cryptography (Important)	2021-03-03
oval:org.opensuse.security:def:9854	P	Security update for grub2 (Important)	2021-03-02
oval:org.opensuse.security:def:38656	P	Security update for MozillaFirefox (Important)	2021-03-01
oval:org.opensuse.security:def:10396	P	Security update for php7 (Important)	2021-02-24
oval:org.opensuse.security:def:9644	P	Security update for the Linux Kernel (Important)	2021-02-19
oval:org.opensuse.security:def:9836	P	Security update for subversion (Important)	2021-02-10
oval:org.opensuse.security:def:38723	P	Security update for avahi (Moderate)	2021-01-18
oval:org.opensuse.security:def:38298	P	Security update for python (Moderate)	2021-01-05
oval:org.opensuse.security:def:10585	P	Security update for the Linux Kernel (Important)	2020-12-09
oval:org.opensuse.security:def:16832	P	libjavascriptcoregtk-1_0-0-2.4.11-23.20 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16889	P	libsolv-devel-0.6.36-2.16.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16923	P	libzypp-devel-16.20.0-2.39.4 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16800	P	libcdio++0-0.90-6.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16901	P	libtiff-devel-4.0.9-44.30.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:16690	P	audiofile-devel-0.3.6-11.3.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:38767	P	pam_ssh on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33136	P	libQtWebKit4-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:9977	P	python-pywbem on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38548	P	at on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:39447	P	Security update for php5 (Important)	2020-12-01
oval:org.opensuse.security:def:33226	P	pcsc-ccid on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10011	P	vsftpd on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29206	P	Security update for openssl (Moderate)	2020-12-01
oval:org.opensuse.security:def:33864	P	Security update for jasper	2020-12-01
oval:org.opensuse.security:def:10813	P	libxml2-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33456	P	Security update for icu	2020-12-01
oval:org.opensuse.security:def:33135	P	libMagickCore1-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29125	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:33601	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:29878	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:29565	P	Security update for OpenEXR (Moderate)	2020-12-01
oval:org.opensuse.security:def:9903	P	libpng15-15 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33815	P	Security update for glib2 (Moderate)	2020-12-01
oval:org.opensuse.security:def:30560	P	Security update for OpenSSL	2020-12-01
oval:org.opensuse.security:def:37906	P	libkde4-32bit on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29772	P	Security update for glibc (Important)	2020-12-01
oval:org.opensuse.security:def:9925	P	libtasn1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10447	P	gnome-settings-daemon-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38001	P	mailx on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38240	P	libHX28 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:37905	P	libjson-c2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:9930	P	libupsclient1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38388	P	libupsclient1 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:17587	P	Security update for php5 (Important)	2020-12-01
oval:org.opensuse.security:def:39405	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:33147	P	libexif on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:9992	P	squid on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38607	P	gnome-settings-daemon on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29137	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:33361	P	Security update for openssl1 (Moderate)	2020-12-01
oval:org.opensuse.security:def:29337	P	Security update for spacewalk	2020-12-01
oval:org.opensuse.security:def:10835	P	php5-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:33513	P	Security update for perl-HTML-Parser	2020-12-01
oval:org.opensuse.security:def:29860	P	Security update for the Linux Kernel	2020-12-01
oval:org.opensuse.security:def:29126	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:29922	P	Security update for libexif (Moderate)	2020-12-01
oval:org.opensuse.security:def:29718	P	Security update for MozillaFirefox	2020-12-01
oval:org.opensuse.security:def:9912	P	libqt4 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:30597	P	Security update for php53 (Important)	2020-12-01
oval:org.opensuse.security:def:37917	P	libmms0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:29821	P	Security update for java-1_6_0-ibm (Important)	2020-12-01
oval:org.opensuse.security:def:10563	P	libxcb-composite0 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:10460	P	lhasa-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38138	P	bash on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:38695	P	liblua5_2 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:17561	P	Security update for DirectFB (Important)	2020-12-01
oval:com.ubuntu.precise:def:20154644000	V	CVE-2015-4644 on Ubuntu 12.04 LTS (precise) - low.	2016-05-16
oval:com.ubuntu.trusty:def:20154644000	V	CVE-2015-4644 on Ubuntu 14.04 LTS (trusty) - low.	2016-05-16
oval:org.cisecurity:def:116	P	DSA-3344-1 -- php5 -- security update	2016-02-08

BACK