CVE-2015-7804: apple mac_os_x Numeric Errors
Vulnerability summary
CVE-2015-7804 is a medium (CVSS 6.8) Numeric Errors vulnerability in apple mac_os_x. EPSS estimates a 8.46% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities.
Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 1Timeline
- 11-12-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (uninitialized pointer dereference and application crash) by including the / filename in a .zip PHAR archive.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
8.46%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
Decrease -0.34 pp
From 8.80% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Apple1 product
- mac_os_x≤ 10.11.1
Php1 product
- phpEOL≤ 5.5.29 | 5.6.0 | 5.6.1 | 5.6.2 | 5.6.3 | 5.6.4 | 5.6.5 | 5.6.6 | 5.6.7 | 5.6.8 | 5.6.9 | 5.6.10 | 5.6.11 | 5.6.12 | 5.6.13
Ubuntu1 product
- php5< 5.5.9+dfsg-1ubuntu4.14
3 vendors · 3 products
References
15 links
- www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.461720Vendor AdvisoryX Refsource SLACKWARE
- www.php.net/ChangeLog-5.phpX Refsource CONFIRM