CVE-2015-2331
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as...
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.
- Record
CVE-2015-2331- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.
- Record
CVE-2015-2331- Updated
- 2026-11-02
EUVDEUVD-2015-2424 No score
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.
- Record
EUVD-2015-2424- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wfcw-88hm-m2xm No score
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as...
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.
- Record
GHSA-wfcw-88hm-m2xm- Updated
- 2026-11-02
OSVBELL-CVE-2015-2331
CVE-2015-2331 does not affect BellSoft software
- Record
BELL-CVE-2015-2331- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSVCLSA-2020-1605798462 No score
Fix of 227 CVE
- Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
- Fix bug #70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()
- Fix bug #70661: Use After Free Vulnerability in WDDX Packet Deserialization
- Fix bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
- Fix bug #71459: Integer overflow in iptcembed()
- Fix bug #71039: exec functions ignore length but look for NULL termination
- Fix bug #71354: Heap corruption in tar/zip/phar parser.
- Fix bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
- Fix bug #71323: Output of stream_get_meta_data can be falsified by its input
- Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()
- Fix bug #71587: Use-After-Free / Double-Free in WDDX Deserialize
- Fix bug #71860: Invalid memory write in phar on filename with \0 in name
- Fix bug #71798: Integer Overflow in php_raw_url_encode
- Fix bug #72837: integer overflow in bzdecompress caused heap corruption
- Fix bug #72681: PHP Session Data Injection Vulnerability
- Fix bug #72807: integer overflow in curl_escape caused heap corruption
- Fix bug #72838: Integer overflow lead to heap corruption in sql_regcase
- Fix bug #72697: select_colors write out-of-bounds
- Fix bug #72730: imagegammacorrect allows arbitrary write access
- Fix bug #72836: integer overflow in base64_decode caused heap corruption
- Fix bug #72848: integer overflow in quoted_printable_encode caused heap corruption
- Fix bug #72849: integer overflow in urlencode caused heap corruption
- Fix bug #72850: integer overflow in php_uuencode caused heap corruption
- Fix bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack
- Fix bug #72749: wddx_deserialize allows illegal memory access
- Fix bug #72750: wddx_deserialize null dereference
- Fix bug #72790: wddx_deserialize null dereference with invalid xml
- Fix bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
- Fix bug #73189: Memcpy negative size parameter php_resolve_path
- Fix bug #73150: missing NULL check in dom_document_save_html
- Fix bug #73284: heap overflow in php_ereg_replace function
- Fix bug #73218: stack-buffer-overflow through "ResourceBundle" methods
- Fix bug #73208: integer overflow in imap_8bit caused heap corruption
- Fix bug #73082: string length overflow in mb_encode_* function
- Fix bug #73174: heap overflow in php_pcre_replace_impl
- Fix bug #73276: crash in openssl_random_pseudo_bytes function
- Fix bug #73275: crash in openssl_encrypt function
- Fix bug #73017: memory corruption in wordwrap function
- Fix bug #73240: Write out of bounds at number_format
- Fix bug #73073: CachingIterator null dereference when convert to string
- Fix bug #73293: NULL pointer dereference in SimpleXMLElement::asXML()
- Fix bug #73356: crash in bzcompress function
- Fix bug #72696: imagefilltoborder stackoverflow on truecolor images
- Fix bug #73418: Integer Overflow in "_php_imap_mail" leads Heap Overflow
- Fix bug #73144: Use-after-free in ArrayObject Deserialization
- Fix bug #73192: parse_url return wrong hostname
- Fix bug #73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow
- Fix bug #73452: Segfault (Regression for #69152)
- Fix bug #73631: Invalid read when wddx decodes empty boolean element
- Fix bug #67587: Redirection loop on nginx with FPM
- Fix bug #71465: PHAR doesn't know about litespeed
- Fix bug #73737: FPE when parsing a tag format
- Fix bug #73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
- Fix bug #73869: Signed Integer Overflow gd_io.c
- Fix bug #73773: Seg fault when loading hostile phar
- Fix bug #70436: Use After Free Vulnerability in unserialize()
- Fix bug #74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
- Fix bug #72535: arcfour encryption stream filter crashes php
- Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unseria
- Fix bug #72455: Heap Overflow due to integer overflows
- Fix bug #74782:…
- Record
CLSA-2020-1605798462- Updated
- 2026-11-02
Show 8 moreShow less
OSV No score
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.
- Record
CVE-2015-2331- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-2331 No score
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.
- Record
DEBIAN-CVE-2015-2331- Updated
- 2026-11-02
OSVMGASA-2015-0134 No score
Updated php and libzip packages fix security vulnerabilities
Heap overflow vulnerability in regcomp.c in the ereg extension in PHP before 5.5.23 on 32-bit systems (CVE-2015-2305).
Integer overflow in zip extension in PHP before 5.5.23 leads to writing past heap boundary (CVE-2015-2331).
Use after free vulnerability in unserialize() in PHP before 5.5.23 (CVE-2015-2787).
PHP has been updated to version 5.5.23, which fixes these issues and other bugs. The php zip extension uses the libzip library, so it has been patched to fix CVE-2015-2331.
- Record
MGASA-2015-0134- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10113-1 No score
libzip-devel-1.1.3-1.4 on GA media
These are all security issues fixed in the libzip-devel-1.1.3-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10113-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10290-1 No score
apache2-mod_php7-7.0.14-1.4 on GA media
These are all security issues fixed in the apache2-mod_php7-7.0.14-1.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10290-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10344-1 No score
apache2-mod_php5-5.6.28-1.1 on GA media
These are all security issues fixed in the apache2-mod_php5-5.6.28-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10344-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0668-1 No score
Security update for libzip
Libzip was updated to fix one security issue.
A zip file with an unusually large number of entries could have caused an integer overflow leading to a write past the heap boundary, crashing the application. (CVE-2015-2331 bnc#923240)
- Record
SUSE-SU-2015:0668-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-2331 No score
Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.
- Record
UBUNTU-CVE-2015-2331- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-bcmathTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-cliTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-commonTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-dbaTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-develTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-embeddedTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-enchantTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-fpmTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-gdTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
php-imapTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-intlTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-ldapTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-mbstringTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-mysqlTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-odbcTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-pdoTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-pgsqlTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-processTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-pspellTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-recodeTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-snmpTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-soapTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-tidyTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-xmlTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-xmlrpcTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
php-ztsTuxCare:CentOS:6 From an advisory covering 70 CVEs |
before 5.3.3-51.el6.cloudlinux | 5.3.3-51.el6.cloudlinux |
libzipDebian:12 |
before 0.11.2-1.2 | 0.11.2-1.2 |
libzipDebian:13 |
before 0.11.2-1.2 | 0.11.2-1.2 |
libzipDebian:14 |
before 0.11.2-1.2 | 0.11.2-1.2 |
php5Debian:6.0 From an advisory covering 8 CVEs |
before 5.3.3.1-7+squeeze26, plus listed versions 5.3.3-75.3.3-7+squeeze15.3.3-7+squeeze135.3.3-7+squeeze145.3.3-7+squeeze15 Show 17 moreShow less5.3.3-7+squeeze165.3.3-7+squeeze175.3.3-7+squeeze185.3.3-7+squeeze195.3.3-7+squeeze25.3.3-7+squeeze205.3.3-7+squeeze215.3.3-7+squeeze225.3.3-7+squeeze235.3.3-7+squeeze245.3.3-7+squeeze255.3.3-7+squeeze35.3.3-7+squeeze55.3.3-7+squeeze65.3.3-7+squeeze75.3.3-7+squeeze85.3.3-7+squeeze9 |
5.3.3.1-7+squeeze26 |
php5Debian:7 From an advisory covering 5 CVEs |
before 5.4.39-0+deb7u1, plus listed versions 5.4.11-15.4.15-15.4.34-0+deb7u15.4.35-0+deb7u15.4.35-0+deb7u2 Show 26 moreShow less5.4.36-0+deb7u15.4.36-0+deb7u35.4.38-0+deb7u15.4.4-145.4.4-14+deb7u15.4.4-14+deb7u105.4.4-14+deb7u115.4.4-14+deb7u125.4.4-14+deb7u135.4.4-14+deb7u145.4.4-14+deb7u25.4.4-14+deb7u35.4.4-14+deb7u45.4.4-14+deb7u55.4.4-14+deb7u75.4.4-14+deb7u85.4.4-14+deb7u95.4.4-155.4.4-15.15.4.6-15.4.6-25.4.8-15.4.9-15.4.9-25.4.9-35.4.9-4 |
5.4.39-0+deb7u1 |
phpMageia:4 From an advisory covering 3 CVEs |
before 5.5.23-1.mga4 | 5.5.23-1.mga4 |
php-apcMageia:4 From an advisory covering 3 CVEs |
before 3.1.15-4.13.mga4 | 3.1.15-4.13.mga4 |
libzipMageia:4 From an advisory covering 3 CVEs |
before 0.11.2-1.1.mga4 | 0.11.2-1.1.mga4 |
libzipSUSE:Linux Enterprise Desktop 12 |
before 0.11.1-6.1 | 0.11.1-6.1 |
libzipSUSE:Linux Enterprise Software Development Kit 12 |
before 0.11.1-6.1 | 0.11.1-6.1 |
libzipSUSE:Linux Enterprise Server 12 |
before 0.11.1-6.1 | 0.11.1-6.1 |
libzipSUSE:Linux Enterprise Server for SAP Applications 12 |
before 0.11.1-6.1 | 0.11.1-6.1 |
libzipopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 1.1.3-1.4 | 1.1.3-1.4 |
php7openSUSE:Tumbleweed From an advisory covering 70 CVEs |
before 7.0.14-1.4 | 7.0.14-1.4 |
php5openSUSE:Tumbleweed From an advisory covering 71 CVEs |
before 5.6.28-1.1 | 5.6.28-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-2331 is a high vulnerability (CVSS 7.5) in Nih Libzip, published March 20, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 27.4%, the 98th percentile. Fixed in libzip 0.11.2-1.2.
References
debian.org/security/2015/dsa-3198
git.php.net?p=php-src.git%3Ba=commit%3Bh=ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5
lists.opensuse.org/opensuse-updates/2015-03/msg00083.html
marc.info?l=bugtraq&m=144050155601375&w=2
lists.fedoraproject.org/pipermail/package-announce/2015-April/155622.html
Show 102 moreShow less
lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
mandriva.com/security/advisories?name=MDVSA-2015:079
oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
php.net/ChangeLog-5.php
support.apple.com/HT205267
bugs.php.net/bug.php?id=69253
hg.nih.at/libzip/rev/9f11d54f692e
securitytracker.com/id/1031985
nvd.nist.gov/vuln/detail/CVE-2015-2331
github.com/advisories/GHSA-wfcw-88hm-m2xm
docs.bell-sw.com/security/cves/CVE-2015-2331
errata.cloudlinux.com/els6/CLSA-2020-1605798462.html
security-tracker.debian.org/tracker/CVE-2015-2331
advisories.mageia.org/MGASA-2015-0134.html
bugs.mageia.org/show_bug.cgi?id=15520
suse.com/support/update/announcement/2015/suse-su-20150668-1
bugzilla.suse.com/923240
ubuntu.com/security/CVE-2015-2331
openwall.com/lists/oss-security/2015/03/18/1
cve.org/CVERecord?id=CVE-2015-2331
Left out here: the rest of 1 source description. The JSON record has them.