Is CVE-2014-9427 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 18%.

What products does CVE-2014-9427 affect?

Tracked products affected include PHP. Check the version you run to see whether it is affected.

How do I fix CVE-2014-9427?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2014-9427

Q: What is CVE-2014-9427?

CVE-2014-9427 is a high-severity software vulnerability (Memory corruption) with a CVSS score of 7.5. sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that

HIGH severity · CVSS 7.5 · Memory corruption

7.5CVSS HIGH

Summary

sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges required—

User interaction—

Confidentiality impact—

Integrity impact—

Availability impact—

Exploit probability (EPSS)18%

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products we track (1)

PHP

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

CVE-2014-9427

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information