Strix
26.1K

CVE-2014-8142

UnknownEPSS 53.17%

Last modified

CVE-2014-8142 is a vulnerability of currently unknown severity. Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.. EPSS estimates a 53.17% chance of exploitation in the next 30 days.

Description

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.

Metrics

EPSS Probability
53.17%

98.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
PhpPhp<= 5.4.35
PhpPhp5.5.0
PhpPhp5.5.1
PhpPhp5.5.2
PhpPhp5.5.3
PhpPhp5.5.4
PhpPhp5.5.5
PhpPhp5.5.6
PhpPhp5.5.7
PhpPhp5.5.8
PhpPhp5.5.9
PhpPhp5.5.10
PhpPhp5.5.11
PhpPhp5.5.12
PhpPhp5.5.13
PhpPhp5.5.14
PhpPhp5.5.15
PhpPhp5.5.16
PhpPhp5.5.17
PhpPhp5.5.18
PhpPhp5.5.19
PhpPhp5.6.0
PhpPhp5.6.1
PhpPhp5.6.2
PhpPhp5.6.3

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2014-8142?
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.
How severe is CVE-2014-8142?
Severity scoring for CVE-2014-8142 is pending analysis. The EPSS model estimates a 53.17% probability of exploitation in the next 30 days.
How do I fix CVE-2014-8142?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2014-8142?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST