CVE-2015-4022: Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, an...

Security readout for executives and security teams

A vulnerable PHP application can be compromised if it asks a malicious or compromised FTP server for a directory listing. The flaw is in PHP's FTP extension and can turn an overly long server response into memory corruption that may allow code execution. Exposure is narrow but serious where PHP FTP features are used. Systems running affected PHP versions are exposed only if PHP code uses the FTP extension to request directory listings from FTP servers, especially untrusted, partner-operated, or compromised servers. Prioritize remediation where legacy PHP applications pull FTP listings from external or third-party servers. This is not broadly internet-triggerable against every PHP host, but affected workflows can lead to full application compromise. Mitigation focus: Upgrade PHP to 5.4.41, 5.5.25, 5.6.9, or a vendor-patched package.; Apply relevant distribution advisories from Red Hat, Debian, openSUSE, Apple, Oracle, Fedora, or Gentoo.; Identify applications using PHP ext/ftp and reduce exposure to untrusted FTP servers..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.