CVE-2014-9767 : Directory traversal vulnerability in the ZipArchive::extractTo function in ext/z

Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.

Published 2016-05-22 01:59:00

Updated 2018-01-05 02:29:58

Source MITRE

View at NVD, CVE.org

Vulnerability category: Directory traversal

Products affected by CVE-2014-9767

PHP » PHP
Versions up to, including, (<=) 5.4.45
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.5
cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.6
cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.1
cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.3
cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.2
cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.4
cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.0
cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.11
cpe:2.3:a:php:php:5.6.11:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.12
cpe:2.3:a:php:php:5.6.12:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.2
cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.7
cpe:2.3:a:php:php:5.6.7:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.8
cpe:2.3:a:php:php:5.6.8:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.9
cpe:2.3:a:php:php:5.6.9:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.1
cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.10
cpe:2.3:a:php:php:5.6.10:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.5
cpe:2.3:a:php:php:5.6.5:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.6
cpe:2.3:a:php:php:5.6.6:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.3
cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.4
cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.8
cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.7
cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.11
cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.10
cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.9
cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.12
cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.13
cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.14
cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.6.0
cpe:2.3:a:php:php:5.6.0:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.18
cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.19
cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.20
cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.21
cpe:2.3:a:php:php:5.5.21:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.26
cpe:2.3:a:php:php:5.5.26:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.25
cpe:2.3:a:php:php:5.5.25:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.22
cpe:2.3:a:php:php:5.5.22:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.28
cpe:2.3:a:php:php:5.5.28:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.27
cpe:2.3:a:php:php:5.5.27:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.24
cpe:2.3:a:php:php:5.5.24:*:*:*:*:*:*:*
Matching versions
PHP » PHP » Version: 5.5.23
cpe:2.3:a:php:php:5.5.23:*:*:*:*:*:*:*
Matching versions
Hiphop Virtual Machine For Php Project » Hiphop Virtual Machine For Php
Versions up to, including, (<=) 3.12
cpe:2.3:a:hiphop_virtual_machine_for_php_project:hiphop_virtual_machine_for_php:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2014-9767

Top countries where our scanners detected CVE-2014-9767

Top open port discovered on systems with this issue 80

IPs affected by CVE-2014-9767 581,445

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2014-9767!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2014-9767

EPSS FAQ

0.93%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 83 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-9767

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE ids for CVE-2014-9767

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-9767

http://www.securityfocus.com/bid/76652

PHP 'php_zip.c' Directory Traversal Vulnerability
http://www.ubuntu.com/usn/USN-2952-1

USN-2952-1: PHP vulnerabilities | Ubuntu security notices

CVEs referencing this url
https://github.com/facebook/hhvm/commit/65c95a01541dd2fbc9c978ac53bed235b5376686

ZipArchive::extractTo bug 70350 · facebook/hhvm@65c95a0 · GitHub
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00058.html

[security-announce] openSUSE-SU-2016:1173-1: important: Security update

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00056.html

[security-announce] SUSE-SU-2016:1166-1: important: Security update for

CVEs referencing this url
https://bugs.php.net/bug.php?id=67996

PHP :: Bug #67996 :: ZipArchive stores and extracts parent directories
Exploit
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html

[security-announce] openSUSE-SU-2016:1167-1: important: Security update

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2952-2

USN-2952-2: PHP regression | Ubuntu security notices

CVEs referencing this url
https://bugs.php.net/bug.php?id=70350

PHP :: Sec Bug #70350 :: ZipArchive::extractTo allows for directory traversal when creating directories
Exploit
http://www.securitytracker.com/id/1035311

PHP ZipArchive::extractTo() May Let Remote Users Traverse the Directory to Create Directories on the Target System - SecurityTracker
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html

[security-announce] SUSE-SU-2016:1145-1: important: Security update for

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2016/03/16/20

oss-security - Re: Three CVE requests for PHP
http://rhn.redhat.com/errata/RHSA-2016-2750.html

RHSA-2016:2750 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://php.net/ChangeLog-5.php

PHP: PHP 5 ChangeLog

CVEs referencing this url