Skip to content
OpenAdvisories
Unscored USN-2391-1 4 CVEs

php5 vulnerabilities

Published Oct 30, 2014 · Updated Apr 22, 2026

Summary

Symeon Paraschoudis discovered that PHP incorrectly handled the mkgmtime
function. A remote attacker could possibly use this issue to cause PHP to
crash, resulting in a denial of service. (CVE-2014-3668)

Symeon Paraschoudis discovered that PHP incorrectly handled unserializing
objects. A remote attacker could possibly use this issue to cause PHP to
crash, resulting in a denial of service. (CVE-2014-3669)

Otto Ebeling discovered that PHP incorrectly handled the exif_thumbnail
function. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2014-3670)

Francisco Alonso that PHP incorrectly handled ELF files in the fileinfo
extension. A remote attacker could possibly use this issue to cause PHP to
crash, resulting in a denial of service. (CVE-2014-3710)

It was discovered that PHP incorrectly handled NULL bytes when processing
certain URLs with the curl functions. A remote attacker could possibly use
this issue to bypass filename restrictions and obtain access to sensitive
files. (No CVE number)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS php5 5.5.9+dfsg-1ubuntu4.5

Vulnerabilities 4

  • Unscored —
    CVE-2014-3668 EPSS 27%

    Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC ex…

  • Unscored —
    CVE-2014-3669 EPSS 29%

    Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.…

  • Unscored —
    CVE-2014-3670 EPSS 23%

    The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x b…

  • Unscored —
    CVE-2014-3710 EPSS 14%

    The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure…

References

  • report
    https://ubuntu.com/security/CVE-2014-3668
  • report
    https://ubuntu.com/security/CVE-2014-3669
  • report
    https://ubuntu.com/security/CVE-2014-3670
  • report
    https://ubuntu.com/security/CVE-2014-3710