Lucene search
AmazonALAS-2015-464HistoryJan 08, 2015 - 11:35 a.m.
Medium: php55
2015-01-0811:35:00
alas.aws.amazon.com
32
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.861 High
EPSS
Percentile
98.5%
Issue Overview:
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.
Affected Packages:
php55
Issue Correction:
Run yum update php55 to update your system.
New Packages:
i686:
php55-xmlrpc-5.5.20-2.94.amzn1.i686
php55-embedded-5.5.20-2.94.amzn1.i686
php55-dba-5.5.20-2.94.amzn1.i686
php55-pgsql-5.5.20-2.94.amzn1.i686
php55-gmp-5.5.20-2.94.amzn1.i686
php55-enchant-5.5.20-2.94.amzn1.i686
php55-soap-5.5.20-2.94.amzn1.i686
php55-mbstring-5.5.20-2.94.amzn1.i686
php55-ldap-5.5.20-2.94.amzn1.i686
php55-common-5.5.20-2.94.amzn1.i686
php55-intl-5.5.20-2.94.amzn1.i686
php55-imap-5.5.20-2.94.amzn1.i686
php55-pdo-5.5.20-2.94.amzn1.i686
php55-mysqlnd-5.5.20-2.94.amzn1.i686
php55-debuginfo-5.5.20-2.94.amzn1.i686
php55-pspell-5.5.20-2.94.amzn1.i686
php55-opcache-5.5.20-2.94.amzn1.i686
php55-gd-5.5.20-2.94.amzn1.i686
php55-recode-5.5.20-2.94.amzn1.i686
php55-process-5.5.20-2.94.amzn1.i686
php55-cli-5.5.20-2.94.amzn1.i686
php55-devel-5.5.20-2.94.amzn1.i686
php55-xml-5.5.20-2.94.amzn1.i686
php55-tidy-5.5.20-2.94.amzn1.i686
php55-mcrypt-5.5.20-2.94.amzn1.i686
php55-snmp-5.5.20-2.94.amzn1.i686
php55-mssql-5.5.20-2.94.amzn1.i686
php55-fpm-5.5.20-2.94.amzn1.i686
php55-odbc-5.5.20-2.94.amzn1.i686
php55-bcmath-5.5.20-2.94.amzn1.i686
php55-5.5.20-2.94.amzn1.i686
src:
php55-5.5.20-2.94.amzn1.src
x86_64:
php55-process-5.5.20-2.94.amzn1.x86_64
php55-enchant-5.5.20-2.94.amzn1.x86_64
php55-xmlrpc-5.5.20-2.94.amzn1.x86_64
php55-pspell-5.5.20-2.94.amzn1.x86_64
php55-pdo-5.5.20-2.94.amzn1.x86_64
php55-pgsql-5.5.20-2.94.amzn1.x86_64
php55-fpm-5.5.20-2.94.amzn1.x86_64
php55-xml-5.5.20-2.94.amzn1.x86_64
php55-odbc-5.5.20-2.94.amzn1.x86_64
php55-cli-5.5.20-2.94.amzn1.x86_64
php55-tidy-5.5.20-2.94.amzn1.x86_64
php55-soap-5.5.20-2.94.amzn1.x86_64
php55-opcache-5.5.20-2.94.amzn1.x86_64
php55-snmp-5.5.20-2.94.amzn1.x86_64
php55-mysqlnd-5.5.20-2.94.amzn1.x86_64
php55-gd-5.5.20-2.94.amzn1.x86_64
php55-bcmath-5.5.20-2.94.amzn1.x86_64
php55-common-5.5.20-2.94.amzn1.x86_64
php55-devel-5.5.20-2.94.amzn1.x86_64
php55-recode-5.5.20-2.94.amzn1.x86_64
php55-mbstring-5.5.20-2.94.amzn1.x86_64
php55-gmp-5.5.20-2.94.amzn1.x86_64
php55-mcrypt-5.5.20-2.94.amzn1.x86_64
php55-intl-5.5.20-2.94.amzn1.x86_64
php55-dba-5.5.20-2.94.amzn1.x86_64
php55-ldap-5.5.20-2.94.amzn1.x86_64
php55-imap-5.5.20-2.94.amzn1.x86_64
php55-5.5.20-2.94.amzn1.x86_64
php55-debuginfo-5.5.20-2.94.amzn1.x86_64
php55-embedded-5.5.20-2.94.amzn1.x86_64
php55-mssql-5.5.20-2.94.amzn1.x86_64
Additional References
Red Hat: CVE-2014-8142
Mitre: CVE-2014-8142
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | php55-xmlrpc | < 5.5.20-2.94.amzn1 | php55-xmlrpc-5.5.20-2.94.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-embedded | < 5.5.20-2.94.amzn1 | php55-embedded-5.5.20-2.94.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-dba | < 5.5.20-2.94.amzn1 | php55-dba-5.5.20-2.94.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-pgsql | < 5.5.20-2.94.amzn1 | php55-pgsql-5.5.20-2.94.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-gmp | < 5.5.20-2.94.amzn1 | php55-gmp-5.5.20-2.94.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-enchant | < 5.5.20-2.94.amzn1 | php55-enchant-5.5.20-2.94.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-soap | < 5.5.20-2.94.amzn1 | php55-soap-5.5.20-2.94.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-mbstring | < 5.5.20-2.94.amzn1 | php55-mbstring-5.5.20-2.94.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-ldap | < 5.5.20-2.94.amzn1 | php55-ldap-5.5.20-2.94.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | php55-common | < 5.5.20-2.94.amzn1 | php55-common-5.5.20-2.94.amzn1.i686.rpm |
Related
nessus
nessus
Amazon Linux AMI : php54 (ALAS-2015-463)
2015-01-09 00:00:00
Amazon Linux AMI : php55 (ALAS-2015-464)
2015-01-09 00:00:00
SUSE SLES12 Security Update : php5 (SUSE-SU-2015:0365-1)
2019-01-02 00:00:00
openvas
openvas
Amazon Linux: Security Advisory (ALAS-2015-463)
2015-09-08 00:00:00
Amazon Linux: Security Advisory (ALAS-2015-464)
2015-09-08 00:00:00
SUSE: Security Advisory (SUSE-SU-2015:0365-1)
2021-06-09 00:00:00
f5
f5
SOL16021 - PHP vulnerability CVE-2014-8142
2015-01-22 00:00:00
K16021 : PHP vulnerability CVE-2014-8142
2015-01-22 00:00:00
cve
cve
amazon
amazon
securityvulns
securityvulns
PHP security vulnerabilities
2014-12-23 00:00:00
[slackware-security] php (SSA:2014-356-02)
2014-12-23 00:00:00
Advisory 01/2004: Multiple vulnerabilities in PHP 4/5
2004-12-16 00:00:00
veracode
veracode
Arbitrary Code Execution
2019-01-15 09:06:10
Remote Code Execution (RCE) Via Memory Corruption
2019-05-02 05:39:23
Memory Corruption
2019-05-02 05:39:23
prion
prion
Design/Logic Flaw
2014-12-20 11:59:00
Design/Logic Flaw
2015-01-27 20:03:00
ubuntucve
ubuntucve
suse
suse
Security update for php5 (important)
2015-02-24 11:05:36
remote code execution in php4, mod_php4
2005-01-17 17:12:32
Security update for php53 (important)
2016-06-21 13:08:17
archlinux
archlinux
php: use after free
2014-12-19 00:00:00
php: remote code execution
2015-01-23 00:00:00
mageia
mageia
Updated php packages fix CVE-2014-8142
2014-12-21 23:47:32
exploitdb
exploitdb
eFront 3.6.15 - PHP Object Injection
2015-05-11 00:00:00
debian
debian
[SECURITY] [DSA 3117-1] php5 security update
2014-12-31 14:47:01
[SECURITY] [DSA 3117-1] php5 security update
2014-12-31 14:47:01
exploitpack
exploitpack
eFront 3.6.15 - PHP Object Injection
2015-05-11 00:00:00
checkpoint_advisories
checkpoint_advisories
PHP Core unserialize process nested data Use After Free (CVE-2014-8142)
2015-02-09 00:00:00
fedora
fedora
[SECURITY] Fedora 21 Update: php-5.6.4-2.fc21
2014-12-29 09:59:23
[SECURITY] Fedora 20 Update: php-5.5.20-2.fc20
2014-12-29 10:03:10
[SECURITY] Fedora 21 Update: php-5.6.5-1.fc21
2015-02-06 03:59:46
packetstorm
packetstorm
eFront 3.6.15 PHP Object Injection
2015-05-09 00:00:00
redhat
redhat
(RHSA-2005:031) php security update
2005-01-19 00:00:00
(RHSA-2005:032) php security update
2005-02-15 00:00:00
(RHSA-2005:838) php security update
2005-11-10 00:00:00
ubuntu
ubuntu
PHP vulnerabilities
2004-12-17 00:00:00
PHP vulnerabilities
2015-02-17 00:00:00
freebsd
freebsd
php -- multiple vulnerabilities
2004-12-16 00:00:00
slackware
slackware
[slackware-security] php
2014-12-23 05:38:55
centos
centos
php security update
2005-11-10 23:45:48
php security update
2015-06-24 03:28:02
gentoo
gentoo
PHP: Multiple vulnerabilities
2004-12-19 00:00:00
PHP: Multiple vulnerabilities
2015-03-08 00:00:00
oraclelinux
oraclelinux
php55 security and bug fix update
2016-02-04 00:00:00
php54 security and bug fix update
2016-02-04 00:00:00
php security and bug fix update
2015-06-23 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2021-1950
2021-07-02 17:57:45
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.861 High
EPSS
Percentile
98.5%
Related for ALAS-2015-464