Rapid7 Vulnerability & Exploit Database

USN-2276-1: PHP vulnerabilities

Free InsightVM Trial No credit card necessary

Watch Demo See how it all works

Back to Search

USN-2276-1: PHP vulnerabilities

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

Published

07/06/2014

Created

07/25/2018

Added

07/10/2014

Modified

07/09/2020

Description

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.

Solution(s)

ubuntu-upgrade-libapache2-mod-php5
ubuntu-upgrade-php5-cgi
ubuntu-upgrade-php5-cli
ubuntu-upgrade-php5-fpm

References

https://attackerkb.com/topics/cve-2014-0207
APPLE-SA-2015-04-08-2
CVE - 2014-0207
CVE - 2014-3478
CVE - 2014-3479
CVE - 2014-3480
CVE - 2014-3487
CVE - 2014-3515
CVE - 2014-4670
CVE - 2014-4698
CVE - 2014-4721
DSA-2974
DSA-3008
DSA-3021
RHSA-2014:1326
RHSA-2014:1327
RHSA-2014:1765
RHSA-2014:1766
USN-2276-1

Advanced vulnerability management analytics and reporting.

Key Features

Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;