CVE-2014-4721: Infoleak
The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHPAUTHPW, PHPAUTHTYPE, PHPAUTHUSER, and PHPSELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a "type confusion" vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with modssl and a PHP 5.3.x modphp.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4721?
CVE-2014-4721 has a critical severity rating as it may allow attackers to access sensitive information.
Which versions of PHP are affected by CVE-2014-4721?
CVE-2014-4721 affects PHP versions before 5.4.30 and 5.5.x before 5.5.14.
How do I fix CVE-2014-4721?
To fix CVE-2014-4721, upgrade PHP to a version that is 5.4.30 or later, or 5.5.14 or later.
What are the potential impacts of CVE-2014-4721?
The potential impacts of CVE-2014-4721 include exposure of sensitive data such as authentication credentials.
Are there any specific mitigations for CVE-2014-4721?
The best mitigation for CVE-2014-4721 is to ensure the use of secure PHP versions and implement proper security configurations.