« Volver al listado

CVE-2015-9253

Estado: ModificadaMedia (6.5)—

Se ha descubierto un problema en PHP en versiones 7.3.x anteriores a la 7.3.0alpha3, versiones 7.2.x anteriores a la 7.2.8 y anteriores a la 7.1.20. El proceso maestro php-fpm reinicia un proceso hijo en un bucle infinito cuando se utilizan funciones de ejecución de programas (por ejemplo, passthru, exec, shell_exec o system) con un flujo non-blocking-STDIN y consumir el espacio del disco con un gran volumen de logs de error, tal y como queda demostrado con un ataque a un cliente de una instalación de alojamiento compartido.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

PHP — PHP

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-9253",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-02-19T19:29:00.483",
  "references": [
    {
      "url": "https://bugs.php.net/bug.php?id=70185",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=73342https://github.com/php/php-src/pull/3287",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=75968",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/php/php-src/blob/PHP-7.1.20/NEWS#L20-L22",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://usn.ubuntu.com/3766-1/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://usn.ubuntu.com/4279-1/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.futureweb.at/security/CVE-2015-9253/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=70185",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=73342https://github.com/php/php-src/pull/3287",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=75968",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/php/php-src/blob/PHP-7.1.20/NEWS#L20-L22",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://usn.ubuntu.com/3766-1/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://usn.ubuntu.com/4279-1/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.futureweb.at/security/CVE-2015-9253/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema en PHP en versiones 7.3.x anteriores a la 7.3.0alpha3, versiones 7.2.x anteriores a la 7.2.8 y anteriores a la 7.1.20. El proceso maestro php-fpm reinicia un proceso hijo en un bucle infinito cuando se utilizan funciones de ejecución de programas (por ejemplo, passthru, exec, shell_exec o system) con un flujo non-blocking-STDIN y consumir el espacio del disco con un gran volumen de logs de error, tal y como queda demostrado con un ataque a un cliente de una instalación de alojamiento compartido."
    }
  ],
  "lastModified": "2026-06-17T00:36:08.780",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23681551-9B0F-4EE5-A15D-6C8A2838DDB7",
              "versionEndExcluding": "7.1.20"
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF1D395B-6711-40A9-8E0E-9153B8A71F04",
              "versionEndExcluding": "7.2.8",
              "versionStartIncluding": "7.2.0"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.3.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F88F1A8-6775-41D4-A726-6902D6A87AF1"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.3.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D52D342A-CAB9-434D-8668-2FEDBA741A81"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}