The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a .phar file with a crafted TAR archive entry in which the Link indicator references a file that does not exist.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Php | Php | * | 5.5.29 (including) |
| Php | Php | 5.6.1 (including) | 5.6.1 (including) |
| Php | Php | 5.6.2 (including) | 5.6.2 (including) |
| Php | Php | 5.6.3 (including) | 5.6.3 (including) |
| Php | Php | 5.6.4 (including) | 5.6.4 (including) |
| Php | Php | 5.6.5 (including) | 5.6.5 (including) |
| Php | Php | 5.6.6 (including) | 5.6.6 (including) |
| Php | Php | 5.6.7 (including) | 5.6.7 (including) |
| Php | Php | 5.6.8 (including) | 5.6.8 (including) |
| Php | Php | 5.6.9 (including) | 5.6.9 (including) |
| Php | Php | 5.6.10 (including) | 5.6.10 (including) |
| Php | Php | 5.6.11 (including) | 5.6.11 (including) |
| Php | Php | 5.6.12 (including) | 5.6.12 (including) |
| Php | Php | 5.6.13 (including) | 5.6.13 (including) |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | rh-php56-php-0:5.6.5-8.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS | RedHat | rh-php56-php-0:5.6.5-8.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | RedHat | rh-php56-php-0:5.6.5-8.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-php56-php-0:5.6.5-8.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS | RedHat | rh-php56-php-0:5.6.5-8.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS | RedHat | rh-php56-php-0:5.6.5-8.el7 | * |
| Php5 | Ubuntu | devel | * |
| Php5 | Ubuntu | precise | * |
| Php5 | Ubuntu | trusty | * |
| Php5 | Ubuntu | upstream | * |
| Php5 | Ubuntu | vivid | * |
| Php5 | Ubuntu | wily | * |