Vulnerability Description
Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | <= 5.4.45 |
| Hiphop Virtual Machine For Php Project | Hiphop Virtual Machine For Php | <= 3.12 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00056.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00058.html
- http://php.net/ChangeLog-5.php
- http://rhn.redhat.com/errata/RHSA-2016-2750.html
- http://www.openwall.com/lists/oss-security/2016/03/16/20
- http://www.securityfocus.com/bid/76652
- http://www.securitytracker.com/id/1035311
- http://www.ubuntu.com/usn/USN-2952-1
- http://www.ubuntu.com/usn/USN-2952-2
- https://bugs.php.net/bug.php?id=67996Exploit
- https://bugs.php.net/bug.php?id=70350Exploit
- https://github.com/facebook/hhvm/commit/65c95a01541dd2fbc9c978ac53bed235b5376686
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html
FAQ
What is CVE-2014-9767?
CVE-2014-9767 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3...
How severe is CVE-2014-9767?
CVE-2014-9767 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-9767?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Hiphop Virtual Machine For Php Project Hiphop Virtual Machine For Php.