CVE-2014-3669

high · 7.5

Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value.

7.5

CVSS

28.9%

EPSS (exploit prob.)

98th

EPSS percentile

2014-10-29

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-189

Affected products

Vendor	Product	Affected versions
php	php	<= 5.4.33
php	php	5.4.0
php	php	5.4.1
php	php	5.4.2
php	php	5.4.3
php	php	5.4.4
php	php	5.4.5
php	php	5.4.6
php	php	5.4.7
php	php	5.4.8
php	php	5.4.9
php	php	5.4.10
php	php	5.4.11
php	php	5.4.12
php	php	5.4.12
php	php	5.4.12
php	php	5.4.13
php	php	5.4.13
php	php	5.4.14
php	php	5.4.14
php	php	5.4.15
php	php	5.4.16
php	php	5.4.17
php	php	5.4.18
php	php	5.4.19
php	php	5.4.20
php	php	5.4.21
php	php	5.4.22
php	php	5.4.23
php	php	5.4.24
php	php	5.4.25
php	php	5.4.26
php	php	5.4.27
php	php	5.4.28
php	php	5.4.29
php	php	5.4.30
php	php	5.4.31
php	php	5.4.32
php	php	5.5.0
php	php	5.5.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-3669