{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-12-18T00:00:00", "descriptions": [{"lang": "en", "value": "Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-12-29T18:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "71791", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/71791"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1175718"}, {"name": "HPSBMU03409", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=144050155601375&w=2"}, {"name": "SUSE-SU-2015:0365", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html"}, {"name": "HPSBMU03380", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=143748090628601&w=2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=630f9c33c23639de85c3fd306b209b538b73b4c9"}, {"name": "SSRT102066", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://php.net/ChangeLog-5.php"}, {"name": "openSUSE-SU-2015:0325", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html"}, {"name": "DSA-3117", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2014/dsa-3117"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"}, {"name": "RHSA-2015:1135", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1135.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.php.net/bug.php?id=68594"}, {"name": "RHSA-2015:1053", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"}, {"name": "GLSA-201503-03", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201503-03"}, {"name": "HPSBUX03337", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2"}, {"name": "RHSA-2015:1066", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2014-8142", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "71791", "refsource": "BID", "url": "http://www.securityfocus.com/bid/71791"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1175718", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1175718"}, {"name": "HPSBMU03409", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=144050155601375&w=2"}, {"name": "SUSE-SU-2015:0365", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html"}, {"name": "HPSBMU03380", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=143748090628601&w=2"}, {"name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"}, {"name": "http://git.php.net/?p=php-src.git;a=commit;h=630f9c33c23639de85c3fd306b209b538b73b4c9", "refsource": "CONFIRM", "url": "http://git.php.net/?p=php-src.git;a=commit;h=630f9c33c23639de85c3fd306b209b538b73b4c9"}, {"name": "SSRT102066", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2"}, {"name": "http://php.net/ChangeLog-5.php", "refsource": "CONFIRM", "url": "http://php.net/ChangeLog-5.php"}, {"name": "openSUSE-SU-2015:0325", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html"}, {"name": "DSA-3117", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2014/dsa-3117"}, {"name": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"}, {"name": "RHSA-2015:1135", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1135.html"}, {"name": "https://bugs.php.net/bug.php?id=68594", "refsource": "CONFIRM", "url": "https://bugs.php.net/bug.php?id=68594"}, {"name": "RHSA-2015:1053", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"}, {"name": "GLSA-201503-03", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201503-03"}, {"name": "HPSBUX03337", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2"}, {"name": "RHSA-2015:1066", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T13:10:51.133Z"}, "title": "CVE Program Container", "references": [{"name": "71791", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/71791"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1175718"}, {"name": "HPSBMU03409", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=144050155601375&w=2"}, {"name": "SUSE-SU-2015:0365", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html"}, {"name": "HPSBMU03380", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=143748090628601&w=2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=630f9c33c23639de85c3fd306b209b538b73b4c9"}, {"name": "SSRT102066", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://php.net/ChangeLog-5.php"}, {"name": "openSUSE-SU-2015:0325", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html"}, {"name": "DSA-3117", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2014/dsa-3117"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"}, {"name": "RHSA-2015:1135", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1135.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.php.net/bug.php?id=68594"}, {"name": "RHSA-2015:1053", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"}, {"name": "GLSA-201503-03", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201503-03"}, {"name": "HPSBUX03337", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2"}, {"name": "RHSA-2015:1066", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2014-8142", "datePublished": "2014-12-20T11:00:00", "dateReserved": "2014-10-10T00:00:00", "dateUpdated": "2024-08-06T13:10:51.133Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "039D6C9C-C3EA-434C-ADD0-CFFBAD9CFE0E", "versionEndIncluding": "5.4.35", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "9F6D9B19-E64D-4BED-9194-17460CE19E6F", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "3D25E591-448C-4E3B-8557-6E48F7571796", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "6DA18F3F-B4B5-40C3-BF19-67C1F0C1787D", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "3AF783C9-26E7-4E02-BD41-77B9783667E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*", "matchCriteriaId": "EF49701D-ECE4-4CEB-BDAB-24C09C8AD4B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*", "matchCriteriaId": "7AEDF6F7-001D-4A35-A26F-417991AD377F", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*", "matchCriteriaId": "4031DB99-B4B4-41EC-B3C1-543D92C575A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "D5450EA7-A398-49D2-AA8E-7C95B074BAB1", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "04FE0E4E-BC94-4DC9-BE9B-DC57B952B2FB", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "BB8E09D8-9CBE-4279-88B7-24A214A5A537", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "2D41ECCE-887D-49A2-9BB3-B559495AC55B", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "79B418BC-27F4-4443-A0F7-FF4ADA568C1B", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "8EEBDF62-BA1B-4438-9AEA-8B56AA5713E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "F644EA6C-50C6-4A1C-A4AC-287AA9477B46", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "4DD47F30-74F5-48E8-8657-C2373FE2BD22", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*", "matchCriteriaId": "0C09527B-6B47-41F8-BDE6-01C47E452286", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*", "matchCriteriaId": "2E454D87-23CB-4D7F-90FE-942EE54D661F", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*", "matchCriteriaId": "1031E646-F2CF-4A3E-8E6A-5D4BC950BEDA", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*", "matchCriteriaId": "130E50C1-D209-4CFF-9399-69D561340FBB", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*", "matchCriteriaId": "C1F29948-9417-460B-8B04-D91AE4E8B423", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*", "matchCriteriaId": "A37D00C1-4F41-4400-9CE4-8E8BAA3E4142", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*", "matchCriteriaId": "093D08B7-CC3C-4616-8697-F15B253A7D9A", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*", "matchCriteriaId": "E9CD8FEE-DE7B-47CB-9985-4092BFA071D0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*", "matchCriteriaId": "A30B2D9E-F289-43C9-BFBC-1CEF284A417E", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*", "matchCriteriaId": "FE41CFDF-8ECD-41C1-94A7-5AFD42C5DDEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*", "matchCriteriaId": "6AEAC9BA-AF82-4345-839C-D339DCB962A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*", "matchCriteriaId": "1EFE682F-52E3-48EC-A993-F522FC29712F", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.15:*:*:*:*:*:*:*", "matchCriteriaId": "840EE3AC-5293-4F33-9E2C-96A0A2534B02", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.16:*:*:*:*:*:*:*", "matchCriteriaId": "1C0FC407-96DB-425E-BB57-7A5BA839C37F", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.17:*:*:*:*:*:*:*", "matchCriteriaId": "D3839C81-3DAB-4E1D-9D95-BEFFD491F43D", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*", "matchCriteriaId": "AC63A449-5D92-4F5F-8186-B58FFFBA54FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*", "matchCriteriaId": "F18236F6-2065-4A6A-93E7-FD90E650C689", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "CE65D0D4-CB56-4946-AB44-2EF554602A96", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "5BF4E8FF-A3EC-43E8-A0C1-FD38AFCB77B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*", "matchCriteriaId": "54ADECFC-3C07-43BC-B296-6C25AC7F1C95", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*", "matchCriteriaId": "FE192054-2FBB-4388-A52A-422E20DEA2D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*", "matchCriteriaId": "F0195D48-3B42-4AC0-B9C5-436E01C63879", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*", "matchCriteriaId": "BF0E5D67-ABC1-41A5-94E1-7DD3CDB51D81", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "319E0573-B1AD-40B6-B4BC-8BE67ED3EFDB", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "1A7C00EB-87B7-4EB7-A4AC-8665D8C78467", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "21BFCF10-786A-4D1E-9C37-50A1EC6056F1", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "95A6D6C8-5F46-4897-A0B0-778631E8CE6A", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "F1F13E2D-A8F7-4B74-8D03-7905C81672C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "AE18933A-5FE6-41C7-B1B6-DA3E762C3FB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*", "matchCriteriaId": "9AE1289F-03A6-4621-B387-5F5ADAC4AE92", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019."}, {"lang": "es", "value": "Vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n en la funci\u00f3n process_nested_data en core/dom/ProcessingInstruction.cpp en ext/standard/var_unserializer.re en PHP anterior a 5.4.36, 5.5.x anterior a 5.5.20, y 5.6.x anterior a 5.6.4, permite a atacantes remotos ejecutar c\u00f3digo arbitrario mediante una petici\u00f3n manipulada no serializada que aprovecha un tratamiento incorrecto de las claves duplicadas sin sin las propiedades serializadas de un objeto, una vulnerabilidad diferente de CVE-2004-1019."}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/416.html\">CWE-416: Use After Free</a>", "id": "CVE-2014-8142", "lastModified": "2023-11-07T02:22:15.750", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-12-20T11:59:00.057", "references": [{"source": "secalert@redhat.com", "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=630f9c33c23639de85c3fd306b209b538b73b4c9"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html"}, {"source": "secalert@redhat.com", "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html"}, {"source": "secalert@redhat.com", "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2"}, {"source": "secalert@redhat.com", "url": "http://marc.info/?l=bugtraq&m=143748090628601&w=2"}, {"source": "secalert@redhat.com", "url": "http://marc.info/?l=bugtraq&m=144050155601375&w=2"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://php.net/ChangeLog-5.php"}, {"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html"}, {"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html"}, {"source": "secalert@redhat.com", "url": "http://rhn.redhat.com/errata/RHSA-2015-1135.html"}, {"source": "secalert@redhat.com", "url": "http://www.debian.org/security/2014/dsa-3117"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"}, {"source": "secalert@redhat.com", "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/71791"}, {"source": "secalert@redhat.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://bugs.php.net/bug.php?id=68594"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1175718"}, {"source": "secalert@redhat.com", "url": "https://security.gentoo.org/glsa/201503-03"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2015:1135", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "php-0:5.4.16-36.ael7b_1", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2015-06-23T00:00:00Z"}, {"advisory": "RHSA-2015:1053", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php55-0:2.0-1.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1053", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php55-php-0:5.5.21-2.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php54-0:2.0-1.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php54-php-0:5.4.40-1.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php54-php-pecl-zendopcache-0:7.0.4-3.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1053", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php55-0:2.0-1.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1053", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php55-php-0:5.5.21-2.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php54-0:2.0-1.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php54-php-0:5.4.40-1.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php54-php-pecl-zendopcache-0:7.0.4-3.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1053", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php55-0:2.0-1.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1053", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php55-php-0:5.5.21-2.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php54-0:2.0-1.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php54-php-0:5.4.40-1.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "php54-php-pecl-zendopcache-0:7.0.4-3.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1053", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7", "package": "php55-0:2.0-1.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1053", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7", "package": "php55-php-0:5.5.21-2.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7", "package": "php54-0:2.0-1.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7", "package": "php54-php-0:5.4.40-1.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2015-06-04T00:00:00Z"}, {"advisory": "RHSA-2015:1066", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7", "package": "php54-php-pecl-zendopcache-0:7.0.4-3.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2015-06-04T00:00:00Z"}], "bugzilla": {"description": "php: use after free vulnerability in unserialize()", "id": "1175718", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1175718"}, "csaw": false, "cvss": {"cvss_base_score": "5.1", "cvss_scoring_vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "status": "verified"}, "cwe": "CWE-416", "details": ["Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.", "A flaws was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code."], "name": "CVE-2014-8142", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "php", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "php53", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "php", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:1", "fix_state": "Affected", "package_name": "php54-php", "product_name": "Red Hat Software Collections"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:1", "fix_state": "Affected", "package_name": "php55-php", "product_name": "Red Hat Software Collections"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:2", "fix_state": "Not affected", "package_name": "rh-php56-php", "product_name": "Red Hat Software Collections"}], "public_date": "2014-12-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-8142\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-8142"], "statement": "This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5 and 6 or the versions of php53 as shipped with Red Hat Enterprise Linux 5.\nThe PHP manual documents that using unserialize() on untrusted user input is unsafe and not recommended.", "threat_severity": "Moderate", "upstream_fix": "php 5.4.36, php 5.5.20, php 5.6.4"}