ID:6440 - Exploit for Use-after-free in PHP - CVE-2014-8142

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4. A remote attacker can trigger memory corruption via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object and execute arbitrary code. Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Remediation