Integer overflow in PHP - CVE-2014-3669
Published: November 27, 2018
Vulnerability identifier: #VU16098
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-3669
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2. A remote attacker can trigger memory corruption via an argument to the unserialize function that triggers calculation of a large length value and cause the service to crash or execute arbitrary code.
Affected software
PHP
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Slackware Linux
Fedora
php5 (Ubuntu package)
php
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Slackware Linux
Fedora
php5 (Ubuntu package)
php
How to mitigate CVE-2014-3669
Install updates from vendor's website.
PHP - addressed in versions 5.4.34, 5.5.18, 5.6.2
php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.28, 5.3.10-1ubuntu3.15
php - update to 5.6.2-1.fc21
php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.28, 5.3.10-1ubuntu3.15
php - update to 5.6.2-1.fc21