$ cve CVE-2015-4643 JSON

CVE-2015-4643

9.8

CRITICAL · CVSS 3.0 · EPSS 16.3% (pctl 97)

Patch early

EPSS 16.3% — above the 10% action threshold.

Description

Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.

Scoring

CVSS	9.8 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	16.32% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	none known
Published	2016-05-16
Last modified	2026-06-17

Affected (9)

Vendor	Product
debian	debian linux
oracle	linux
php	php
redhat	enterprise linux desktop
redhat	enterprise linux server
redhat	enterprise linux server aus
redhat	enterprise linux server eus
redhat	enterprise linux server tus
redhat	enterprise linux workstation

References

→ the Explorer · watch your stack · NVD