blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2014-3515

HIGH 7.5 CVSS 2.0
Published
July 9, 2014
Last modified
June 17, 2026
NVD status
Modified
Reported by
secalert@redhat.com
CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.

Affected products and versions

  • PHP — Before 5.3.29
  • PHP — From 5.4.0 (including) to 5.4.30 (excluding)
  • PHP — From 5.5.0 (including) to 5.5.14 (excluding)

References

  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=88223c5245e9b470e1e6362bfd96829562ffe6ab
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html Mailing List, Third Party Advisory
  • marc.info http://marc.info/?l=bugtraq&m=141017844705317&w=2 Mailing List, Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2014-1765.html Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2014-1766.html Third Party Advisory
  • secunia.com http://secunia.com/advisories/59794 Third Party Advisory
  • secunia.com http://secunia.com/advisories/59831 Third Party Advisory
  • secunia.com http://secunia.com/advisories/60998 Third Party Advisory
  • support.apple.com http://support.apple.com/kb/HT6443 Third Party Advisory
  • www-01.ibm.com http://www-01.ibm.com/support/docview.wss?uid=swg21683486 Third Party Advisory
  • www.debian.org http://www.debian.org/security/2014/dsa-2974 Third Party Advisory
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html Third Party Advisory
  • www.php.net http://www.php.net/ChangeLog-5.php Vendor Advisory
  • www.securityfocus.com http://www.securityfocus.com/bid/68237 Third Party Advisory, VDB Entry
  • bugs.php.net https://bugs.php.net/bug.php?id=67492 Patch, Vendor Advisory
  • nvd.nist.gov Official NVD record