CVE-2014-8142: Use After Free

Q: What is the severity of CVE-2014-8142?

CVE-2014-8142 is considered to be a critical vulnerability due to the potential for arbitrary code execution.

Q: How do I fix CVE-2014-8142?

To fix CVE-2014-8142, upgrade PHP to version 5.4.36, 5.5.20, or 5.6.4 or later.

Q: What systems are affected by CVE-2014-8142?

CVE-2014-8142 affects specific versions of PHP, including all versions before 5.4.36, 5.5.20, and 5.6.4.

Q: What causes the CVE-2014-8142 vulnerability?

CVE-2014-8142 is caused by a use-after-free flaw in the PHP unserialize() function.

Q: What could happen if CVE-2014-8142 is exploited?

Exploitation of CVE-2014-8142 could lead to a crash of the PHP interpreter or the execution of arbitrary code.

Published Dec 18, 2014

Updated

A use-after-free flaw was found in PHP unserialize(). An untrusted input could cause PHP interpreter to crash or, possibly, execute arbitrary code when processed using unserialize().

Upstream bug (currently private):

https://bugs.php.net/bug.php?id=68594

Upstream commit:

http://git.php.net/?p=php-src.git;a=commitdiff;h=630f9c33c23639de85c3fd306b209b538b73b4c9 http://git.php.net/?p=php-src.git;a=commitdiff;h=53f129a44d3c4ec0fae57993b9ae2f6cb48973cc

Note that unserialize() is unsafe for use on untrusted inputs, as is documented in the PHP manual for the function:

http://php.net/manual/en/function.unserialize.php

Other sources

Use-after-free vulnerability in the processnesteddata function in ext/standard/varunserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.

— MITRE

Affected Software

49 affected componentsFixes available

redhat/php<5.4.36

5.4.36

redhat/php<5.5.20

5.5.20

redhat/php<5.6.4

5.6.4

PHP PHP<=5.4.35

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.6.0

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

Event History

Dec 20, 2014

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-8142?

CVE-2014-8142 is considered to be a critical vulnerability due to the potential for arbitrary code execution.

How do I fix CVE-2014-8142?