Skip to content
OpenAdvisories
Medium USN-2276-1 9 CVEs

php5 vulnerabilities

Published Jul 9, 2014 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Francisco Alonso discovered that the PHP Fileinfo component incorrectly
handled certain CDF documents. A remote attacker could use this issue to
cause PHP to hang or crash, resulting in a denial of service.
(CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)

Stefan Esser discovered that PHP incorrectly handled unserializing SPL
extension objects. An attacker could use this issue to execute arbitrary
code. (CVE-2014-3515)

It was discovered that PHP incorrectly handled certain SPL Iterators. An
attacker could use this issue to cause PHP to crash, resulting in a denial
of service. (CVE-2014-4670)

It was discovered that PHP incorrectly handled certain ArrayIterators. An
attacker could use this issue to cause PHP to crash, resulting in a denial
of service. (CVE-2014-4698)

Stefan Esser discovered that PHP incorrectly handled variable types when
calling phpinfo(). An attacker could use this issue to possibly gain access
to arbitrary memory, possibly containing sensitive information.
(CVE-2014-4721)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS php5 5.5.9+dfsg-1ubuntu4.3

Vulnerabilities 9

  • Medium 6.5
    CVE-2014-0207 EPSS 17%

    The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30…

    php5 file file Debian Ubuntu
  • Medium 6.5
    CVE-2014-3478 EPSS 15%

    Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP b…

    php5 file file Debian Ubuntu
  • Medium 6.5
    CVE-2014-3480 EPSS 11%

    The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5…

    php5 file file Debian Ubuntu
  • Unscored —
    CVE-2014-3479 EPSS 15%

    The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.…

    php5 file file Debian Ubuntu
  • Unscored —
    CVE-2014-3487 EPSS 15%

    The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5…

    php5 file file Debian Ubuntu
  • Unscored —
    CVE-2014-3515 EPSS 30%

    The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures wil…

    php5 Ubuntu
  • Unscored —
    CVE-2014-4670

    Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependen…

    php5 Ubuntu
  • Unscored —
    CVE-2014-4698

    Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent…

    php5 Ubuntu
  • Unscored —
    CVE-2014-4721

    The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of t…

    php5 Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-0207
  • report
    https://ubuntu.com/security/CVE-2014-3478
  • report
    https://ubuntu.com/security/CVE-2014-3479
  • report
    https://ubuntu.com/security/CVE-2014-3480
  • report
    https://ubuntu.com/security/CVE-2014-3487
  • report
    https://ubuntu.com/security/CVE-2014-3515
  • report
    https://ubuntu.com/security/CVE-2014-4670
  • report
    https://ubuntu.com/security/CVE-2014-4698
  • report
    https://ubuntu.com/security/CVE-2014-4721