CVE-2015-5589

What it actually does

The phar_convert_to_other function fails to validate a file pointer before performing a close operation, allowing a crafted TAR archive supplied to Phar::convertToData to trigger a segmentation fault or other unspecified memory corruption.

Why it matters to the business

Web applications and services built on vulnerable PHP versions can experience sudden crashes or unpredictable behavior when processing untrusted archives, leading to service outages and potential data exposure or code execution in worst cases.

How an attack unfolds

An attacker creates a specially malformed TAR archive and causes a PHP application to invoke Phar::convertToData on it, either directly through file upload or indirectly via library code that processes archives; the missing pointer validation then dereferences invalid memory.

How to fix it

Upgrade PHP to version 5.4.43, 5.5.27, or 5.6.11 or later. Disable Phar functionality if the feature is unused. Apply vendor-supplied patches for any downstream distributions.

How to confirm the fix worked

Confirm the installed PHP version is at or above the fixed releases; attempt to reproduce the crash with a known-bad TAR archive in a controlled test environment; review phar_object.c source to verify the pointer check is present.

Typical attack path

1. Craft a malicious TAR archive that triggers the pointer mishandling path
2. Deliver the archive to a PHP application via upload, include, or automated processing
3. Invoke Phar::convertToData on the archive through normal application logic
4. Trigger segmentation fault or memory corruption in the PHP process

How to detect it

Search PHP error logs and system crash reports for segmentation faults originating from ext/phar/phar_object.c or phar_convert_to_other; correlate spikes in application crashes with archive-processing endpoints.

What your security team should do

• Prioritize upgrade of all PHP installations to patched releases
• Inventory applications that use Phar or TAR handling and restrict untrusted archive processing
• Enable PHP error logging and monitor for segmentation faults
• Apply web application firewall rules that block or sanitize archive uploads where feasible