blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2014-8142

HIGH 7.5 CVSS 2.0
Published
December 20, 2014
Last modified
June 17, 2026
NVD status
Modified
Reported by
secalert@redhat.com
CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.

Affected products and versions

  • PHP — Up to and including 5.4.35
  • PHP versions 5.5.0, 5.5.0alpha1, 5.5.0alpha2, 5.5.0alpha3, 5.5.0alpha4, 5.5.0alpha5, 5.5.0alpha6, 5.5.0beta1, 5.5.0beta2, 5.5.0beta3, 5.5.0beta4, 5.5.0rc1, 5.5.0rc2, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.14, 5.5.15, 5.5.16, 5.5.17, 5.5.18, 5.5.19, 5.6.0, 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3

References

  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=630f9c33c23639de85c3fd306b209b538b73b4c9
  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html
  • marc.info http://marc.info/?l=bugtraq&m=143403519711434&w=2
  • marc.info http://marc.info/?l=bugtraq&m=143748090628601&w=2
  • marc.info http://marc.info/?l=bugtraq&m=144050155601375&w=2
  • php.net http://php.net/ChangeLog-5.php Vendor Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1053.html
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1066.html
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-1135.html
  • www.debian.org http://www.debian.org/security/2014/dsa-3117
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
  • www.securityfocus.com http://www.securityfocus.com/bid/71791
  • bugs.php.net https://bugs.php.net/bug.php?id=68594 Exploit, Vendor Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1175718
  • security.gentoo.org https://security.gentoo.org/glsa/201503-03
  • nvd.nist.gov Official NVD record