CVE-2014-3515

HIGH severity · CVSS 7.5

7.5CVSS HIGH

Summary

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges required—

User interaction—

Confidentiality impact—

Integrity impact—

Availability impact—

Exploit probability (EPSS)49%

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products we track (2)

PHP Debian

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=88223c5245e9b470e1e6362bfd96829562ffe6ab
http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.htmlAdvisory
http://marc.info/?l=bugtraq&m=141017844705317&w=2Advisory
http://rhn.redhat.com/errata/RHSA-2014-1765.htmlAdvisory
http://rhn.redhat.com/errata/RHSA-2014-1766.htmlAdvisory
http://secunia.com/advisories/59794Advisory
http://secunia.com/advisories/59831Advisory
http://secunia.com/advisories/60998Advisory