CVE-2015-2301: apple mac_os_x Use After Free

Modified

AliasesUBUNTU-CVE-2015-2301

Published 30-03-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-2301 is a high (CVSS 7.5) Use After Free vulnerability in apple mac_os_x. EPSS estimates a 14.67% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

14.67%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 9 · Related 3

DLA-212-1 DSA-3198-1 RHSA-2015:1053 RHSA-2015:1066 RHSA-2015:1135 RHSA-2015:1218+3 more

Timeline

30-03-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

14.67%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 14.67% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (bugs.php.net)
Maturity: unknown
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat6 products

Show all 6

Apple1 product

mac_os_x≤ 10.10.4

Canonical1 product

ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10

Debian1 product

debian_linuxEOL7.0

Opensuse1 product

opensuseEOL13.1 | 13.2

Php1 product

php≥ 5.4.0, < 5.4.40 | ≥ 5.5.0, < 5.5.22 | ≥ 5.6.0, < 5.6.6

Ubuntu1 product

php5< 5.5.9+dfsg-1ubuntu4.7

7 vendors · 12 products

References

27 links

www.debian.org/security/2015/dsa-3198Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.ubuntu.com/usn/USN-2535-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
marc.info?l=bugtraq&m=144050155601375&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2015-04/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
www.securitytracker.com/id/1031949VDB EntryX Refsource SECTRACKThird Party Advisory
marc.info?l=bugtraq&m=143748090628601&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRMThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2015:079Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlX Refsource CONFIRMThird Party Advisory

Show all 27 references

bugzilla.redhat.com/show_bug.cgi?id=1194747X Refsource CONFIRMIssue TrackingThird Party Advisory
marc.info?l=bugtraq&m=143403519711434&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
php.net/ChangeLog-5.phpX Refsource CONFIRMVendor Advisory
lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
support.apple.com/HT205267X Refsource CONFIRMThird Party Advisory
bugs.php.net/bug.php?id=68901X Refsource CONFIRMExploitVendor Advisory
git.php.net?p=php-src.git%3Ba=commit%3Bh=b2cf3f064b8f5efef89bb084521b61318c71781bX Refsource CONFIRM
www.securityfocus.com/bid/73037VDB EntryX Refsource BIDThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-1135.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-1053.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
openwall.com/lists/oss-security/2015/03/15/6Mailing ListX Refsource MLISTExploit
security.gentoo.org/glsa/201606-10Vendor AdvisoryX Refsource GENTOOThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-1066.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-1218.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
ubuntu.com/security/CVE-2015-2301REPORT
ubuntu.com/security/notices/USN-2535-1Advisory
www.cve.org/CVERecord?id=CVE-2015-2301REPORT