CVE-2015-8878
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure...
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.
- Record
CVE-2015-8878- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:N/I:N/A:C - Weakness
- CWE-119, CWE-362
- Updated
- 2026-11-02
CVE List No score
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.
- Record
CVE-2015-8878- Updated
- 2026-11-02
EUVDEUVD-2015-8734 No score
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.
- Record
EUVD-2015-8734- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5vw7-pjvv-vj46
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure...
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.
- Record
GHSA-5vw7-pjvv-vj46- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php5Debian:7 From an advisory covering 16 CVEs |
before 5.4.45-0+deb7u3, plus listed versions 5.4.11-15.4.15-15.4.34-0+deb7u15.4.35-0+deb7u15.4.35-0+deb7u2 Show 32 moreShow less5.4.36-0+deb7u15.4.36-0+deb7u35.4.38-0+deb7u15.4.39-0+deb7u15.4.39-0+deb7u25.4.4-145.4.4-14+deb7u15.4.4-14+deb7u105.4.4-14+deb7u115.4.4-14+deb7u125.4.4-14+deb7u135.4.4-14+deb7u145.4.4-14+deb7u25.4.4-14+deb7u35.4.4-14+deb7u45.4.4-14+deb7u55.4.4-14+deb7u75.4.4-14+deb7u85.4.4-14+deb7u95.4.4-155.4.4-15.15.4.41-0+deb7u15.4.44-0+deb7u15.4.45-0+deb7u15.4.45-0+deb7u25.4.6-15.4.6-25.4.8-15.4.9-15.4.9-25.4.9-35.4.9-4 |
5.4.45-0+deb7u3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-8878 is a medium vulnerability (CVSS 5.9) in Php, published May 22, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. No source names a fixed version.