CVE-2015-8617

Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

22.81% chance of exploitation in the next 30 days, 98th percentile

Published

2016-01-19

Updated

2024-08-06

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/39082

References

• CVE Record
• NVD entry

Related

• CVE-2015-8612
• CVE-2015-8620
• CVE-2015-8608
• CVE-2015-8634
• CVE-2015-8566
• CVE-2015-8635