CVE-2014-4670

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.

References

http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html

http://lists.opensuse.org/opensuse-updates/2014-07/msg00035.html

http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html

http://rhn.redhat.com/errata/RHSA-2014-1326.html

http://rhn.redhat.com/errata/RHSA-2014-1327.html

http://rhn.redhat.com/errata/RHSA-2014-1765.html

http://rhn.redhat.com/errata/RHSA-2014-1766.html

http://secunia.com/advisories/54553

http://secunia.com/advisories/59831

http://secunia.com/advisories/60696

http://www.debian.org/security/2014/dsa-3008

http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html

http://www-01.ibm.com/support/docview.wss?uid=swg21683486

https://bugs.php.net/bug.php?id=67538

https://support.apple.com/HT204659

Details

Source: MITRE

Published: 2014-07-10

Updated: 2017-01-07

Risk Information

CVSS v2

Base Score: 4.6

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 3.9

Severity: MEDIUM

Tenable Plugins

View all (25 total)

IDNameProductFamilySeverity
700510Mac OS X 10.10.x < 10.10.3 Multiple VulnerabilitiesNessus Network MonitorOperating System Detection
critical
93161SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)NessusSuSE Local Security Checks
critical
82700Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)NessusMacOS X Local Security Checks
critical
82699Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK)NessusMacOS X Local Security Checks
critical
82333Mandriva Linux Security Advisory : php (MDVSA-2015:080)NessusMandriva Local Security Checks
high
78556PHP 5.6.0 Multiple VulnerabilitiesNessusCGI abuses
high
78419Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64 (20140930)NessusScientific Linux Local Security Checks
medium
78009RHEL 7 : php (RHSA-2014:1327)NessusRed Hat Local Security Checks
medium
78005Oracle Linux 7 : php (ELSA-2014-1327)NessusOracle Linux Local Security Checks
medium
78004Oracle Linux 5 / 6 : php / php53 (ELSA-2014-1326)NessusOracle Linux Local Security Checks
medium
77996CentOS 7 : php (CESA-2014:1327)NessusCentOS Local Security Checks
medium
77995CentOS 5 / 6 : php / php53 (CESA-2014:1326)NessusCentOS Local Security Checks
medium
77980RHEL 5 / 6 : php53 and php (RHSA-2014:1326)NessusRed Hat Local Security Checks
medium
77543Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : php (SSA:2014-247-01)NessusSlackware Local Security Checks
medium
77455GLSA-201408-11 : PHP: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
8360PHP 5.4.x < 5.4.32 / 5.5.x < 5.5.16 Multiple VulnerabilitiesNessus Network MonitorWeb Servers
high
77402PHP 5.4.x < 5.4.32 Multiple VulnerabilitiesNessusCGI abuses
medium
77307Debian DSA-3008-1 : php5 - security updateNessusDebian Local Security Checks
medium
77037Mandriva Linux Security Advisory : php (MDVSA-2014:149)NessusMandriva Local Security Checks
medium
76957openSUSE Security Update : php5 (openSUSE-2014-471)NessusSuSE Local Security Checks
medium
76932openSUSE Security Update : openSUSE-2014- (openSUSE-2014--1)NessusSuSE Local Security Checks
medium
76929openSUSE Security Update : openSUSE-2014- (openSUSE-2014--1)NessusSuSE Local Security Checks
medium
76909SuSE 11.3 Security Update : PHP 5.3 (SAT Patch Number 9537)NessusSuSE Local Security Checks
high
76772PHP 5.5.x < 5.5.15 Multiple VulnerabilitiesNessusCGI abuses
medium
76451Ubuntu 10.04 LTS / 12.04 LTS / 13.10 / 14.04 LTS : php5 vulnerabilities (USN-2276-1)NessusUbuntu Local Security Checks
high