CVE-2014-4670MEDIUM
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.
References
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
http://lists.opensuse.org/opensuse-updates/2014-07/msg00035.html
http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html
http://rhn.redhat.com/errata/RHSA-2014-1326.html
http://rhn.redhat.com/errata/RHSA-2014-1327.html
http://rhn.redhat.com/errata/RHSA-2014-1765.html
http://rhn.redhat.com/errata/RHSA-2014-1766.html
http://secunia.com/advisories/54553
http://secunia.com/advisories/59831
http://secunia.com/advisories/60696
http://www.debian.org/security/2014/dsa-3008
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://www-01.ibm.com/support/docview.wss?uid=swg21683486
Details
Source: MITRE
Published: 2014-07-10
Updated: 2017-01-07
Type: NVD-CWE-Other
Risk Information
CVSS v2
Base Score: 4.6
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 3.9
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* versions up to 5.5.14 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 700510 | Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities | Nessus Network Monitor | Operating System Detection | critical |
| 93161 | SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM) | Nessus | SuSE Local Security Checks | critical |
| 82700 | Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK) | Nessus | MacOS X Local Security Checks | critical |
| 82699 | Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK) | Nessus | MacOS X Local Security Checks | critical |
| 82333 | Mandriva Linux Security Advisory : php (MDVSA-2015:080) | Nessus | Mandriva Local Security Checks | high |
| 78556 | PHP 5.6.0 Multiple Vulnerabilities | Nessus | CGI abuses | high |
| 78419 | Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64 (20140930) | Nessus | Scientific Linux Local Security Checks | medium |
| 78009 | RHEL 7 : php (RHSA-2014:1327) | Nessus | Red Hat Local Security Checks | medium |
| 78005 | Oracle Linux 7 : php (ELSA-2014-1327) | Nessus | Oracle Linux Local Security Checks | medium |
| 78004 | Oracle Linux 5 / 6 : php / php53 (ELSA-2014-1326) | Nessus | Oracle Linux Local Security Checks | medium |
| 77996 | CentOS 7 : php (CESA-2014:1327) | Nessus | CentOS Local Security Checks | medium |
| 77995 | CentOS 5 / 6 : php / php53 (CESA-2014:1326) | Nessus | CentOS Local Security Checks | medium |
| 77980 | RHEL 5 / 6 : php53 and php (RHSA-2014:1326) | Nessus | Red Hat Local Security Checks | medium |
| 77543 | Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : php (SSA:2014-247-01) | Nessus | Slackware Local Security Checks | medium |
| 77455 | GLSA-201408-11 : PHP: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 8360 | PHP 5.4.x < 5.4.32 / 5.5.x < 5.5.16 Multiple Vulnerabilities | Nessus Network Monitor | Web Servers | high |
| 77402 | PHP 5.4.x < 5.4.32 Multiple Vulnerabilities | Nessus | CGI abuses | medium |
| 77307 | Debian DSA-3008-1 : php5 - security update | Nessus | Debian Local Security Checks | medium |
| 77037 | Mandriva Linux Security Advisory : php (MDVSA-2014:149) | Nessus | Mandriva Local Security Checks | medium |
| 76957 | openSUSE Security Update : php5 (openSUSE-2014-471) | Nessus | SuSE Local Security Checks | medium |
| 76932 | openSUSE Security Update : openSUSE-2014- (openSUSE-2014--1) | Nessus | SuSE Local Security Checks | medium |
| 76929 | openSUSE Security Update : openSUSE-2014- (openSUSE-2014--1) | Nessus | SuSE Local Security Checks | medium |
| 76909 | SuSE 11.3 Security Update : PHP 5.3 (SAT Patch Number 9537) | Nessus | SuSE Local Security Checks | high |
| 76772 | PHP 5.5.x < 5.5.15 Multiple Vulnerabilities | Nessus | CGI abuses | medium |
| 76451 | Ubuntu 10.04 LTS / 12.04 LTS / 13.10 / 14.04 LTS : php5 vulnerabilities (USN-2276-1) | Nessus | Ubuntu Local Security Checks | high |