CVE-2015-4604: php Improper Input Validation
Vulnerability summary
CVE-2015-4604 is a high (CVSS 7.5) Improper Input Validation vulnerability in php. EPSS estimates a 7.39% chance of exploitation in the next 30 days, higher than 94.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 6 · Related 1Timeline
- 16-05-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
7.39%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.39% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugs.php.net)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat7 products
- enterprise_linuxEOL6.0 | 7.0
- enterprise_linux_desktop7.0
- enterprise_linux_hpc_node7.0
- enterprise_linux_hpc_node_eus7.1
- enterprise_linux_server7.0
Php1 product
- phpEOL≤ 5.4.39 | 5.5.0 | 5.5.1 | 5.5.2 | 5.5.3 | 5.5.4 | 5.5.5 | 5.5.6 | 5.5.7 | 5.5.8 | 5.5.9 | 5.5.10 | 5.5.11 | 5.5.12 | 5.5.13 | 5.5.14 | 5.5.15 | 5.5.16 | 5.5.17 | 5.5.18 | 5.5.19 | 5.5.20 | 5.5.21 | 5.5.22 | 5.5.23 | 5.6.0 | 5.6.1 | 5.6.2 | 5.6.3 | 5.6.4 | 5.6.5 | 5.6.6 | 5.6.7
Ubuntu1 product
- php5< 5.5.9+dfsg-1ubuntu4.9
3 vendors · 9 products
References
13 links- www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRM
- php.net/ChangeLog-5.phpX Refsource CONFIRM