CVE-2015-2348 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2015-2348 Interim 1 25 2023-12-08T02:15:24Z current 2021-05-30T13:28:26Z 2023-12-08T02:15:24Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2015-2348 The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2015-May/001380.html E-Mail link for SUSE-SU-2015:0868-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Liberty Linux 7 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Server 11 SP1 for Teradata SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Module for Web and Scripting 12 apache2-mod_php5-5.5.14-22.1 php-5.4.16-36.el7_1 php-bcmath-5.4.16-36.el7_1 php-cli-5.4.16-36.el7_1 php-common-5.4.16-36.el7_1 php-dba-5.4.16-36.el7_1 php-devel-5.4.16-36.el7_1 php-embedded-5.4.16-36.el7_1 php-enchant-5.4.16-36.el7_1 php-fpm-5.4.16-36.el7_1 php-gd-5.4.16-36.el7_1 php-intl-5.4.16-36.el7_1 php-ldap-5.4.16-36.el7_1 php-mbstring-5.4.16-36.el7_1 php-mysql-5.4.16-36.el7_1 php-mysqlnd-5.4.16-36.el7_1 php-odbc-5.4.16-36.el7_1 php-pdo-5.4.16-36.el7_1 php-pgsql-5.4.16-36.el7_1 php-process-5.4.16-36.el7_1 php-pspell-5.4.16-36.el7_1 php-recode-5.4.16-36.el7_1 php-snmp-5.4.16-36.el7_1 php-soap-5.4.16-36.el7_1 php-xml-5.4.16-36.el7_1 php-xmlrpc-5.4.16-36.el7_1 php5 php5-5.5.14-22.1 php5-bcmath-5.5.14-22.1 php5-bz2-5.5.14-22.1 php5-calendar-5.5.14-22.1 php5-ctype-5.5.14-22.1 php5-curl-5.5.14-22.1 php5-dba-5.5.14-22.1 php5-devel-5.5.14-108.1 php5-devel-5.5.14-109.41.1 php5-devel-5.5.14-22.1 php5-devel-5.5.14-39.1 php5-devel-5.5.14-73.1 php5-dom-5.5.14-22.1 php5-enchant-5.5.14-22.1 php5-exif-5.5.14-22.1 php5-fastcgi-5.5.14-22.1 php5-fileinfo-5.5.14-22.1 php5-fpm-5.5.14-22.1 php5-ftp-5.5.14-22.1 php5-gd-5.5.14-22.1 php5-gettext-5.5.14-22.1 php5-gmp-5.5.14-22.1 php5-iconv-5.5.14-22.1 php5-intl-5.5.14-22.1 php5-json-5.5.14-22.1 php5-ldap-5.5.14-22.1 php5-mbstring-5.5.14-22.1 php5-mcrypt-5.5.14-22.1 php5-mysql-5.5.14-22.1 php5-odbc-5.5.14-22.1 php5-openssl-5.5.14-22.1 php5-pcntl-5.5.14-22.1 php5-pdo-5.5.14-22.1 php5-pear-5.5.14-22.1 php5-pgsql-5.5.14-22.1 php5-pspell-5.5.14-22.1 php5-shmop-5.5.14-22.1 php5-snmp-5.5.14-22.1 php5-soap-5.5.14-22.1 php5-sockets-5.5.14-22.1 php5-sqlite-5.5.14-22.1 php5-suhosin-5.5.14-22.1 php5-sysvmsg-5.5.14-22.1 php5-sysvsem-5.5.14-22.1 php5-sysvshm-5.5.14-22.1 php5-tokenizer-5.5.14-22.1 php5-wddx-5.5.14-22.1 php5-xmlreader-5.5.14-22.1 php5-xmlrpc-5.5.14-22.1 php5-xmlwriter-5.5.14-22.1 php5-xsl-5.5.14-22.1 php5-zip-5.5.14-22.1 php5-zlib-5.5.14-22.1 php-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-bcmath-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-cli-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-common-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-dba-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-devel-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-embedded-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-enchant-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-fpm-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-gd-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-intl-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-ldap-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-mbstring-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-mysql-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-mysqlnd-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-odbc-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-pdo-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-pgsql-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-process-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-pspell-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-recode-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-snmp-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-soap-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-xml-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 php-xmlrpc-5.4.16-36.el7_1 as a component of SUSE Liberty Linux 7 apache2-mod_php5-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-bcmath-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-bz2-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-calendar-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-ctype-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-curl-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-dba-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-dom-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-enchant-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-exif-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-fastcgi-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-fileinfo-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-fpm-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-ftp-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-gd-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-gettext-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-gmp-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-iconv-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-intl-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-json-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-ldap-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-mbstring-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-mcrypt-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-mysql-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-odbc-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-openssl-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pcntl-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pdo-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pear-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pgsql-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pspell-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-shmop-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-snmp-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-soap-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sockets-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sqlite-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-suhosin-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sysvmsg-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sysvsem-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sysvshm-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-tokenizer-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-wddx-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xmlreader-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xmlrpc-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xmlwriter-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xsl-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-zip-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-zlib-5.5.14-22.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-devel-5.5.14-22.1 as a component of SUSE Linux Enterprise Software Development Kit 12 php5-devel-5.5.14-39.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 php5-devel-5.5.14-73.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 php5-devel-5.5.14-108.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 php5-devel-5.5.14-109.41.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 php5 as a component of SUSE Linux Enterprise Server 11 SP1 for Teradata The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. CVE-2015-2348 SUSE Liberty Linux 7:php-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-bcmath-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-cli-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-common-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-dba-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-devel-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-embedded-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-enchant-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-fpm-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-gd-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-intl-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-ldap-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-mbstring-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-mysql-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-mysqlnd-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-odbc-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-pdo-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-pgsql-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-process-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-pspell-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-recode-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-snmp-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-soap-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-xml-5.4.16-36.el7_1 SUSE Liberty Linux 7:php-xmlrpc-5.4.16-36.el7_1 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php5-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-bcmath-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-bz2-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-calendar-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ctype-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-curl-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-dba-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-dom-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-enchant-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-exif-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fastcgi-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fileinfo-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fpm-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ftp-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gd-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gettext-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gmp-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-iconv-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-intl-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-json-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ldap-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mbstring-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mcrypt-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mysql-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-odbc-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-openssl-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pcntl-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pdo-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pear-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pgsql-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pspell-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-shmop-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-snmp-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-soap-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sockets-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sqlite-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-suhosin-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvmsg-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvsem-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvshm-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-tokenizer-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-wddx-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlreader-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlrpc-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlwriter-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xsl-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-zip-5.5.14-22.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-zlib-5.5.14-22.1 SUSE Linux Enterprise Software Development Kit 12:php5-devel-5.5.14-22.1 SUSE Linux Enterprise Software Development Kit 12 SP1:php5-devel-5.5.14-39.1 SUSE Linux Enterprise Software Development Kit 12 SP2:php5-devel-5.5.14-73.1 SUSE Linux Enterprise Software Development Kit 12 SP3:php5-devel-5.5.14-108.1 SUSE Linux Enterprise Software Development Kit 12 SP4:php5-devel-5.5.14-109.41.1 SUSE Linux Enterprise Server 11 SP1 for Teradata:php5 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N