CVE-2015-7803

What it actually does

The vulnerability triggers a NULL pointer dereference inside phar_get_entry_data when a crafted TAR archive entry inside a .phar file uses a Link indicator that references a non-existent file, causing the PHP process to crash.

Why it matters to the business

Results in denial-of-service against PHP-based web applications and services that accept or process .phar archives, leading to unplanned downtime and the need for restarts until systems are updated.

How an attack unfolds

An attacker prepares a .phar file whose embedded TAR archive contains a Link entry pointing to a missing file, then causes a vulnerable PHP installation to invoke phar_get_entry_data on that archive, producing an immediate application crash.

How to fix it

Upgrade PHP to 5.5.30 or 5.6.14 or later on all affected systems, including Apple macOS installations that bundle PHP. Disable the phar extension when .phar support is unnecessary.

How to confirm the fix worked

Confirm PHP version meets or exceeds 5.5.30 / 5.6.14. Attempt to process a test .phar with an invalid TAR Link entry and verify no crash occurs.

Typical attack path

1. Create a malicious .phar containing a TAR archive with an invalid Link indicator
2. Deliver the .phar to the target application via upload, include, or file processing
3. Trigger phar parsing code path to dereference NULL and crash the process

How to detect it

Review web server and PHP error logs for segmentation faults or crashes occurring during .phar file handling; correlate with file-upload or include operations involving .phar archives.

• phar_get_entry_data
• ext/phar/util.c
• Link indicator references a file that does not exist

What your security team should do

• Apply the PHP version updates immediately across development, staging, and production environments
• Restrict untrusted .phar file uploads and processing until patches are deployed
• Add monitoring for PHP segmentation faults or crashes correlated with phar handling