Skip to content
OpenAdvisories
Unscored USN-2254-1 4 CVEs

php5 vulnerabilities

Published Jun 23, 2014 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Christian Hoffmann discovered that the PHP FastCGI Process Manager (FPM)
set incorrect permissions on the UNIX socket. A local attacker could use
this issue to possibly elevate their privileges. This issue only affected
Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-0185)

Francisco Alonso discovered that the PHP Fileinfo component incorrectly
handled certain CDF documents. A remote attacker could use this issue to
cause PHP to hang or crash, resulting in a denial of service.
(CVE-2014-0237, CVE-2014-0238)

Stefan Esser discovered that PHP incorrectly handled DNS TXT records. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2014-4049)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS php5 5.5.9+dfsg-1ubuntu4.1

Vulnerabilities 4

  • Unscored —
    CVE-2014-0185

    sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 per…

    php5 Ubuntu
  • Unscored —
    CVE-2014-0237 EPSS 20%

    The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 al…

    php5 file Debian Ubuntu
  • Unscored —
    CVE-2014-0238 EPSS 21%

    The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 all…

    php5 file Debian Ubuntu
  • Unscored —
    CVE-2014-4049 EPSS 11%

    Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remot…

    php5 Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-0185
  • report
    https://ubuntu.com/security/CVE-2014-0237
  • report
    https://ubuntu.com/security/CVE-2014-0238
  • report
    https://ubuntu.com/security/CVE-2014-4049