CVE-2014-4049: Buffer Overflow
Heap-based buffer overflow in the phpparserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dnsgetrecord function.
Other sources
Stefan Esser pointed out that the following commit fixes a heap-based buffer overflow in DNS TXT record parsing:
https://github.com/php/php-src/commit/b34d7849ed90ced9345f8ea1c59bc8d101c18468
A malicious server or man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application uses dnsgetrecord() to perform a DNS query.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4049?
CVE-2014-4049 is considered critical as it may lead to denial of service and arbitrary code execution.
How do I fix CVE-2014-4049?
To mitigate CVE-2014-4049, upgrade PHP to a version later than 5.6.0beta4, where the vulnerability is resolved.
Which PHP versions are affected by CVE-2014-4049?
CVE-2014-4049 affects PHP versions from 5.3.0 up to 5.6.0beta4.
Can CVE-2014-4049 lead to data breaches?
Yes, due to the potential for arbitrary code execution, CVE-2014-4049 could lead to unauthorized access and data breaches.
Is CVE-2014-4049 specific to certain operating systems?
CVE-2014-4049 impacts PHP installations across various operating systems including openSUSE and Debian.