CVE-2014-4049

Name: CVE-2014-4049
Creator: NVD / NIST
Published: 2014-06-18T19:55:05.683+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 10.91%

Last modified Jun 17, 2026

CVE-2014-4049 is a vulnerability of currently unknown severity. Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.. EPSS estimates a 10.91% chance of exploitation in the next 30 days.

Description

Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.

Metrics

EPSS Probability

10.91%

95.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-119

Affected Software

Vendor	Product	Versions	Update
Opensuse	Opensuse	11.3	—
Php	Php	>= 5.3.0, < 5.3.29	—
Php	Php	>= 5.4.0, < 5.4.30	—
Php	Php	>= 5.5.0, < 5.5.14	—
Php	Php	5.6.0	Alpha1
Debian	Debian Linux	7.0	—
Debian	Debian Linux	8.0	—

References

http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00002.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-06/msg00051.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-07/msg00032.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=141017844705317&w=2Mailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1765.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1766.htmlThird Party Advisory
http://secunia.com/advisories/59270Third Party Advisory
http://secunia.com/advisories/59329Third Party Advisory
http://secunia.com/advisories/59418Third Party Advisory
http://secunia.com/advisories/59496Third Party Advisory
http://secunia.com/advisories/59513Third Party Advisory
http://secunia.com/advisories/59652Third Party Advisory
http://secunia.com/advisories/60998Third Party Advisory
http://support.apple.com/kb/HT6443Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21683486Third Party Advisory
http://www.debian.org/security/2014/dsa-2961Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/06/13/4Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlThird Party Advisory
http://www.securityfocus.com/bid/68007Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030435Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1108447Issue Tracking
https://github.com/php/php-src/commit/b34d7849ed90ced9345f8ea1c59bc8d101c18468Patch, Third Party Advisory
https://support.apple.com/HT204659Third Party Advisory
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00002.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-06/msg00051.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-07/msg00032.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=141017844705317&w=2Mailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1765.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1766.htmlThird Party Advisory
http://secunia.com/advisories/59270Third Party Advisory
http://secunia.com/advisories/59329Third Party Advisory
http://secunia.com/advisories/59418Third Party Advisory
http://secunia.com/advisories/59496Third Party Advisory
http://secunia.com/advisories/59513Third Party Advisory
http://secunia.com/advisories/59652Third Party Advisory
http://secunia.com/advisories/60998Third Party Advisory
http://support.apple.com/kb/HT6443Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21683486Third Party Advisory
http://www.debian.org/security/2014/dsa-2961Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/06/13/4Mailing List, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlThird Party Advisory
http://www.securityfocus.com/bid/68007Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030435Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1108447Issue Tracking
https://github.com/php/php-src/commit/b34d7849ed90ced9345f8ea1c59bc8d101c18468Patch, Third Party Advisory
https://support.apple.com/HT204659Third Party Advisory

Timeline

Published: Jun 18, 2014
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2014-4049?

How severe is CVE-2014-4049?

Severity scoring for CVE-2014-4049 is pending analysis. The EPSS model estimates a 10.91% probability of exploitation in the next 30 days.

How do I fix CVE-2014-4049?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2014-4049?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST