CVE-2014-4670: Use After Free

Q: What is the severity of CVE-2014-4670?

CVE-2014-4670 has been classified as a high severity vulnerability due to its potential to cause denial of service.

Q: How do I fix CVE-2014-4670?

To fix CVE-2014-4670, upgrade your PHP installation to version 5.5.15 or later.

Q: What versions of PHP are affected by CVE-2014-4670?

CVE-2014-4670 affects PHP versions from 5.5.0 up to and including 5.5.14.

Q: What types of attacks are possible due to CVE-2014-4670?

CVE-2014-4670 can allow context-dependent attackers to cause denial of service through crafted iterator usage.

Q: Is there a workaround for CVE-2014-4670?

There are no officially recommended workarounds for CVE-2014-4670; upgrading PHP is the safest option.

Published Jul 10, 2014

Updated

Use-after-free vulnerability in ext/spl/spldllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.

Affected Software

27 affected components

PHP PHP<=5.5.14

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

Event History

Jul 10, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4670?

CVE-2014-4670 has been classified as a high severity vulnerability due to its potential to cause denial of service.

How do I fix CVE-2014-4670?

To fix CVE-2014-4670, upgrade your PHP installation to version 5.5.15 or later.

What versions of PHP are affected by CVE-2014-4670?