CVE-2014-5459: Low severity PHP PHP vulnerability
Published Aug 25, 2014
·Updated
The PEARREST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions.
Affected Software
7 affected components
debian/php5<=5.4.4-2, <=5.4.4-14+deb7u14
debian/php5
PHP PHP<=5.6.0
Oracle Solaris=11.2
openSUSE Evergreen=11.4
openSUSE openSUSE=12.3
openSUSE openSUSE=13.1
Event History
Sep 27, 2014
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-5459?
CVE-2014-5459 is considered to have a medium severity rating due to its potential for local file exposure and manipulation.
2
How do I fix CVE-2014-5459?
To fix CVE-2014-5459, update PHP to a version above 5.6.0 or apply patches provided by your operating system vendor.
3
Which PHP versions are affected by CVE-2014-5459?
CVE-2014-5459 affects PHP versions up to and including 5.6.0.
4
Can CVE-2014-5459 be exploited remotely?
No, CVE-2014-5459 requires local user access, making remote exploitation unlikely.
5
What is the nature of the attack described in CVE-2014-5459?
The attack involves symlink manipulation to allow arbitrary file writing by exploiting certain cache files.