CVE-2014-4049: Improper Restriction of Operations within the Bounds of a Memory Buffer

🗓️ 18 Jun 2014 00:00:00Reported by Rapid7Type

rapid7🔗 www.rapid7.com👁 3 Views

Heap-based buffer overflow in PHP 5.6.0beta4 and earlier via DNS TXT records enables DoS or RCE.

Reporter	Title	Published	Views	Family All 185
IBM Security Bulletins	Security Bulletin: Vulnerabilities in php5 affect IBM Flex System Manager (FSM): (CVE-2013-4248 CVE-2013-6420 CVE-2014-2497 CVE-2014-4049)	31 Jan 201901:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in PHP as used by IBM QRadar Incident Forensics 7.2 MR2. (CVE-2014-3515, CVE-2014-4049, CVE-2014-3981, CVE-2014-0238, CVE-2014-0237, CVE-2014-4721)	16 Jun 201821:19	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities affect IBM's Advanced Management Module (AMM)	14 Apr 202314:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in PHP affect IBM Chassis Management Module (CMM) (CVE-2013-4248, CVE-2013-6420, CVE-2014-2497, CVE-2014-4049)	31 Jan 201901:55	–	ibm
IBM Security Bulletins	Security Bulletin: Network Intrusion Prevention System is affected by curl and php5 vulnerabilities (CVE-2013-2174, CVE-2014-0015, CVE-2014-0138, CVE-2014-0139, CVE-2013-4248, CVE-2013-6420, CVE-2014-2497, CVE-2014-4049)	23 Feb 202217:14	–	ibm
Tenable Nessus	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities	10 Apr 201900:00	–	nessus
Tenable Nessus	PHP 5.4.x < 5.4.30 / 5.5.x < 5.5.14 Multiple Vulnerabilities	2 Jul 201400:00	–	nessus
Tenable Nessus	Mac OS X < 10.9.5 Multiple Vulnerabilities (Security Update 2014-004)	19 Sep 201400:00	–	nessus
Tenable Nessus	Amazon Linux AMI : php54 (ALAS-2014-367)	12 Oct 201400:00	–	nessus
Tenable Nessus	Amazon Linux AMI : php55 (ALAS-2014-372)	12 Oct 201400:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2014-4049
cwe	www.cwe.mitre.org/data/definitions/119.html

06 Aug 2024 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 25.1

EPSS0.1091

PHP ext/standard/dns.c heap-based buffer overflow dns_get_record denial of service remote code execution