CVE-2014-3597: Buffer Overflow

Q: What is the severity of CVE-2014-3597?

CVE-2014-3597 has a severity rating that suggests it allows remote attackers to cause a denial of service or potentially execute arbitrary code.

Q: How do I fix CVE-2014-3597?

To fix CVE-2014-3597, upgrade to PHP version 5.4.32 or later, or 5.5.16 or later.

Q: Which PHP versions are affected by CVE-2014-3597?

CVE-2014-3597 affects PHP versions prior to 5.4.32 and 5.5.x before 5.5.16.

Q: What vulnerability type is CVE-2014-3597 classified as?

CVE-2014-3597 is classified as a buffer overflow vulnerability.

Q: What could happen if CVE-2014-3597 is exploited?

If CVE-2014-3597 is exploited, it could lead to application crashes or allow attackers to execute arbitrary code.

Published Aug 23, 2014

Updated

Multiple buffer overflows in the phpparserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dnsgetrecord function and the dnexpand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049.

Affected Software

69 affected components

debian/php5

PHP PHP<=5.4.31

PHP PHP=5.4.0

PHP PHP=5.4.0-beta2

PHP PHP=5.4.0-rc2

PHP PHP=5.4.1

PHP PHP=5.4.2

PHP PHP=5.4.3

PHP PHP=5.4.4

PHP PHP=5.4.5

PHP PHP=5.4.6

PHP PHP=5.4.7

PHP PHP=5.4.8

PHP PHP=5.4.9

PHP PHP=5.4.10

PHP PHP=5.4.11

PHP PHP=5.4.12

PHP PHP=5.4.12-rc1

PHP PHP=5.4.12-rc2

PHP PHP=5.4.13

PHP PHP=5.4.13-rc1

PHP PHP=5.4.14

PHP PHP=5.4.14-rc1

PHP PHP=5.4.15

PHP PHP=5.4.15-rc1

PHP PHP=5.4.16-rc1

PHP PHP=5.4.17

PHP PHP=5.4.18

PHP PHP=5.4.19

PHP PHP=5.4.20

PHP PHP=5.4.21

PHP PHP=5.4.22

PHP PHP=5.4.23

PHP PHP=5.4.24

PHP PHP=5.4.25

PHP PHP=5.4.26

PHP PHP=5.4.27

PHP PHP=5.4.28

PHP PHP=5.4.29

PHP PHP=5.4.30

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

Event History

Aug 23, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3597?

CVE-2014-3597 has a severity rating that suggests it allows remote attackers to cause a denial of service or potentially execute arbitrary code.

How do I fix CVE-2014-3597?

To fix CVE-2014-3597, upgrade to PHP version 5.4.32 or later, or 5.5.16 or later.

Which PHP versions are affected by CVE-2014-3597?