CVE-2015-4024 json
Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25,…
published 2015-06-09 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-4052
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 41.8%
- EPSS 41.8% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.
Patch / fix
- php5 Ubuntu 14.04 LTS 5.5.9+dfsg-1ubuntu4.11
ubuntu advisories UBUNTU-CVE-2015-4024
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- php RHEL 6 5.3.3-46.el6_6
- php-gd RHEL 6 5.3.3-46.el6_6
- php-cli RHEL 6 5.3.3-46.el6_6
- php-dba RHEL 6 5.3.3-46.el6_6
- php-fpm RHEL 6 5.3.3-46.el6_6
- php-pdo RHEL 6 5.3.3-46.el6_6
- php-xml RHEL 6 5.3.3-46.el6_6
- php-zts RHEL 6 5.3.3-46.el6_6
red hat advisories RHSA-2015:1218RHSA-2015:1186RHSA-2015:1135RHSA-2015:1187RHSA-2015:1219
- php5 SLE Software Development Kit 12, SLE Module for Web and Scripting 12 5.5.14-30.1
- php53 SLES 11 SP2-LTSS 5.3.17-47.1
suse advisories SUSE-SU-2016:1638-1SUSE-SU-2015:1253-2SUSE-SU-2015:1253-1
- php5 openSUSE Tumbleweed 5.6.28-1.1
opensuse advisories openSUSE-SU-2024:10344-1
- bugs.php.net/bug.php?id=69364 patch
- php.net/ChangeLog-5.php patch
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2015-4024 updated cvss 5.0
php: multipart/form-data request parsing CPU usage DoS
-
Red Hat Enterprise Linux 5 php, php53affected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux Client Optional (v. 7) php 5.4.16-36.el7_1, php-gd 5.4.16-36.el7_1, php-cli 5.4.16-36.el7_1, php-dba 5.4.16-36.el7_1, php-fpm 5.4.16-36.el7_1, php-pdo 5.4.16-36.el7_1, +18 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) php 5.4.16-36.el7_1, php-gd 5.4.16-36.el7_1, php-cli 5.4.16-36.el7_1, php-dba 5.4.16-36.el7_1, php-fpm 5.4.16-36.el7_1, php-pdo 5.4.16-36.el7_1, +18 morefixed: vendor fix RHSA-2015:1135
-
Red Hat Enterprise Linux Desktop Optional (v. 6) php 5.3.3-46.el6_6, php-gd 5.3.3-46.el6_6, php-cli 5.3.3-46.el6_6, php-dba 5.3.3-46.el6_6, php-fpm 5.3.3-46.el6_6, php-pdo 5.3.3-46.el6_6, +20 more Red Hat Enterprise Linux HPC Node (v. 6) php 5.3.3-46.el6_6, php-cli 5.3.3-46.el6_6, php-common 5.3.3-46.el6_6 Red Hat Enterprise Linux HPC Node Optional (v. 6) php 5.3.3-46.el6_6, php-gd 5.3.3-46.el6_6, php-dba 5.3.3-46.el6_6, php-fpm 5.3.3-46.el6_6, php-pdo 5.3.3-46.el6_6, php-xml 5.3.3-46.el6_6, +18 more Red Hat Enterprise Linux Server (v. 6) php 5.3.3-46.el6_6, php-gd 5.3.3-46.el6_6, php-cli 5.3.3-46.el6_6, php-pdo 5.3.3-46.el6_6, php-xml 5.3.3-46.el6_6, php-ldap 5.3.3-46.el6_6, +6 morefixed: vendor fix RHSA-2015:1218
-
Red Hat Enterprise Linux Server (v. 7) php 5.4.16-36.el7_1, php 5.4.16-36.ael7b_1, php-gd 5.4.16-36.el7_1, php-cli 5.4.16-36.el7_1, php-pdo 5.4.16-36.el7_1, php-xml 5.4.16-36.el7_1, +22 morefixed: vendor fix RHSA-2015:1135
-
Red Hat Enterprise Linux Server Optional (v. 6) php-dba 5.3.3-46.el6_6, php-fpm 5.3.3-46.el6_6, php-zts 5.3.3-46.el6_6, php-imap 5.3.3-46.el6_6, php-intl 5.3.3-46.el6_6, php-snmp 5.3.3-46.el6_6, +8 morefixed: vendor fix RHSA-2015:1218
-
Red Hat Enterprise Linux Server Optional (v. 7) php-dba 5.4.16-36.el7_1, php-fpm 5.4.16-36.el7_1, php-intl 5.4.16-36.el7_1, php-snmp 5.4.16-36.el7_1, php-dba 5.4.16-36.ael7b_1, php-fpm 5.4.16-36.ael7b_1, +14 morefixed: vendor fix RHSA-2015:1135
-
Red Hat Enterprise Linux Workstation (v. 6) php 5.3.3-46.el6_6, php-gd 5.3.3-46.el6_6, php-cli 5.3.3-46.el6_6, php-pdo 5.3.3-46.el6_6, php-xml 5.3.3-46.el6_6, php-ldap 5.3.3-46.el6_6, +6 morefixed: vendor fix RHSA-2015:1218
-
Red Hat Enterprise Linux Workstation (v. 7) php 5.4.16-36.el7_1, php-gd 5.4.16-36.el7_1, php-cli 5.4.16-36.el7_1, php-pdo 5.4.16-36.el7_1, php-xml 5.4.16-36.el7_1, php-ldap 5.4.16-36.el7_1, +8 morefixed: vendor fix RHSA-2015:1135
show 3 moreshow fewer
-
Red Hat Enterprise Linux Workstation Optional (v. 6) php-dba 5.3.3-46.el6_6, php-fpm 5.3.3-46.el6_6, php-zts 5.3.3-46.el6_6, php-imap 5.3.3-46.el6_6, php-intl 5.3.3-46.el6_6, php-snmp 5.3.3-46.el6_6, +8 morefixed: vendor fix RHSA-2015:1218
-
Red Hat Enterprise Linux Workstation Optional (v. 7) php-dba 5.4.16-36.el7_1, php-fpm 5.4.16-36.el7_1, php-intl 5.4.16-36.el7_1, php-snmp 5.4.16-36.el7_1, php-bcmath 5.4.16-36.el7_1, php-pspell 5.4.16-36.el7_1, +4 morefixed: vendor fix RHSA-2015:1135
-
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) php54-php 5.4.40-3.el6, php55-php 5.5.21-4.el6, rh-php56-php 5.6.5-7.el6, php54-php-gd 5.4.40-3.el6, php55-php-gd 5.5.21-4.el6, php54-php-cli 5.4.40-3.el6, +72 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) php54-php 5.4.40-3.el7, php55-php 5.5.21-4.el7, rh-php56-php 5.6.5-7.el7, php54-php-gd 5.4.40-3.el7, php55-php-gd 5.5.21-4.el7, php54-php-cli 5.4.40-3.el7, +66 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) php54-php 5.4.40-3.el6, php55-php 5.5.21-4.el6, rh-php56-php 5.6.5-7.el6, php54-php-gd 5.4.40-3.el6, php55-php-gd 5.5.21-4.el6, php54-php-cli 5.4.40-3.el6, +72 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) php54-php 5.4.40-3.el6, php55-php 5.5.21-4.el6, rh-php56-php 5.6.5-7.el6, php54-php-gd 5.4.40-3.el6, php55-php-gd 5.5.21-4.el6, php54-php-cli 5.4.40-3.el6, +72 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) php54-php 5.4.40-3.el7, php55-php 5.5.21-4.el7, rh-php56-php 5.6.5-7.el7, php54-php-gd 5.4.40-3.el7, php55-php-gd 5.5.21-4.el7, php54-php-cli 5.4.40-3.el7, +66 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) php54-php 5.4.40-3.el6, php55-php 5.5.21-4.el6, rh-php56-php 5.6.5-7.el6, php54-php-gd 5.4.40-3.el6, php55-php-gd 5.5.21-4.el6, php54-php-cli 5.4.40-3.el6, +72 morefixed: vendor fix RHSA-2015:1219
+1 more productsfewer
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) php54-php 5.4.40-3.el7, php55-php 5.5.21-4.el7, rh-php56-php 5.6.5-7.el7, php54-php-gd 5.4.40-3.el7, php55-php-gd 5.5.21-4.el7, php54-php-cli 5.4.40-3.el7, +66 more
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
41.79% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- bugs.php.net https://bugs.php.net/bug.php?id=69364 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-399 Resource Management Errors
- Technology feeds
References
-
bugs.php.net
/bug.php?id=69364
exploit, patch
-
php.net
/ChangeLog-5.php
patch
-
rhn.redhat.com
/errata/RHSA-2015-1187.html
vendor-advisory, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2015-1186.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-1219.html
vendor-advisory
-
lists.opensuse.org
/opensuse-updates/2015-06/msg00002.html
vendor-advisory
-
debian.org
/security/2015/dsa-3280
vendor-advisory
-
lists.apple.com
/archives/security-announce/2015/Aug/msg00001.html
vendor-advisory, mailing-list, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2015-1135.html
vendor-advisory, third-party-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2015-May/158915.html
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2015-May/158616.html
vendor-advisory
-
lists.fedoraproject.org
/pipermail/package-announce/2015-May/159031.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2015-1218.html
vendor-advisory
-
securityfocus.com
/bid/74903
vdb-entry
-
securitytracker.com
/id/1032432
vdb-entry
-
oracle.com
/technetwork/topics/security/linuxbulletinjan2016-2867209.html
third-party-advisory
-
oracle.com
/technetwork/topics/security/bulletinjul2015-2511963.html
third-party-advisory
-
h20566.www2.hpe.com
/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763
third-party-advisory
- support.apple.com /kb/HT205031
Sources
- CVE List CVE-2015-4024
- NVD CVE-2015-4024
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.