CVE-2015-8617 | BDVDB-2026-73889 Detail

Description#

Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/php/php-src/commit/b101a6bbd4f2181c360bd38e7683df4a03cba83e
http://www.securitytracker.com/id/1034543
http://php.net/ChangeLog-7.php
https://bugs.php.net/bug.php?id=71105

Exploit#

No public exploit known

History#

Version 12016-01-19Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.