UpHeron
All vulnerabilities

Servers and applications

CVE-2015-8617

Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.

Severity
Critical 9.8
Published
19 Jan 2016
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • Version 7.0.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2015-8617
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2015-8617