CVE-2014-3597

medium · 6.8

Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049.

6.8

CVSS

15.4%

EPSS (exploit prob.)

97th

EPSS percentile

2014-08-23

Published

AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

CWE-119

Affected products

Vendor	Product	Affected versions
php	php	<= 5.4.31
php	php	5.4.0
php	php	5.4.0
php	php	5.4.0
php	php	5.4.0
php	php	5.4.1
php	php	5.4.2
php	php	5.4.3
php	php	5.4.4
php	php	5.4.5
php	php	5.4.6
php	php	5.4.7
php	php	5.4.8
php	php	5.4.9
php	php	5.4.10
php	php	5.4.11
php	php	5.4.12
php	php	5.4.12
php	php	5.4.12
php	php	5.4.13
php	php	5.4.13
php	php	5.4.14
php	php	5.4.14
php	php	5.4.15
php	php	5.4.15
php	php	5.4.16
php	php	5.4.17
php	php	5.4.18
php	php	5.4.19
php	php	5.4.20
php	php	5.4.21
php	php	5.4.22
php	php	5.4.23
php	php	5.4.24
php	php	5.4.25
php	php	5.4.26
php	php	5.4.27
php	php	5.4.28
php	php	5.4.29
php	php	5.4.30

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-3597