Servers and applications
CVE-2015-5589 The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not validate a file pointer before a close operation, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted TAR archive that is mishandled in a Phar::convertToData call.
Severity Critical 9.8
Published 16 May 2016
Last changed 17 Jun 2026
Added to UpHeron 14 Oct 2026
Sources NVD Affected software Software Affected versions PHPServers and applications · cpe:a:php:php Version 5.6.10 Version 5.6.9 Version 5.6.8 Version 5.6.7 All 59 release lines Every version up to 5.4.42 Version 5.5.0-alpha1 Version 5.5.0-alpha2 Version 5.5.0-alpha3 Version 5.5.0-alpha4 Version 5.5.0-alpha5 Version 5.5.0-alpha6 Version 5.5.0-beta1 Version 5.5.0-beta2 Version 5.5.0-beta3 Version 5.5.0-beta4 Version 5.5.0-rc1 Version 5.5.0-rc2 Version 5.5.0 Version 5.5.1 Version 5.5.2 Version 5.5.3 Version 5.5.4 Version 5.5.5 Version 5.5.6 Version 5.5.7 Version 5.5.8 Version 5.5.9 Version 5.5.10 Version 5.5.11 Version 5.5.12 Version 5.5.13 Version 5.5.14 Version 5.5.15 Version 5.5.16 Version 5.5.17 Version 5.5.18 Version 5.5.19 Version 5.5.20 Version 5.5.21 Version 5.5.22 Version 5.5.23 Version 5.5.24 Version 5.5.25 Version 5.5.26 Version 5.6.0-alpha1 Version 5.6.0-alpha2 Version 5.6.0-alpha3 Version 5.6.0-alpha4 Version 5.6.0-alpha5 Version 5.6.0-beta1 Version 5.6.0-beta2 Version 5.6.0-beta3 Version 5.6.0-beta4 Version 5.6.1 Version 5.6.2 Version 5.6.3 Version 5.6.4 Version 5.6.5 Version 5.6.6 Version 5.6.7 Version 5.6.8 Version 5.6.9 Version 5.6.10
References NVD https://nvd.nist.gov/vuln/detail/CVE-2015-5589 CVE.org https://www.cve.org/CVERecord?id=CVE-2015-5589