7.5

CVE-2014-3515

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Php ≫ Php Version < 5.3.29
Php ≫ Php Version >= 5.4.0 < 5.4.30
Php ≫ Php Version >= 5.5.0 < 5.5.14
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 37.41% 0.971
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
http://marc.info/?l=bugtraq&m=141017844705317&w=2
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/68237
Third Party Advisory
VDB Entry