CVE-2014-8142

high · 7.5

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.

7.5

CVSS

53.2%

EPSS (exploit prob.)

99th

EPSS percentile

2014-12-20

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

Vendor	Product	Affected versions
php	php	<= 5.4.35
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.0
php	php	5.5.1
php	php	5.5.2
php	php	5.5.3
php	php	5.5.4
php	php	5.5.5
php	php	5.5.6
php	php	5.5.7
php	php	5.5.8
php	php	5.5.9
php	php	5.5.10
php	php	5.5.11
php	php	5.5.12
php	php	5.5.13
php	php	5.5.14
php	php	5.5.15
php	php	5.5.16
php	php	5.5.17
php	php	5.5.18
php	php	5.5.19
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0
php	php	5.6.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-8142