[arch-security] [ASA-201412-23] php: use after free
anthraxx at archlinux.org
Fri Dec 19 16:02:58 UTC 2014
Arch Linux Security Advisory ASA-201412-23
Date : 2014-12-19
CVE-ID : CVE-2014-8142
Package : php
Type : use after free
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE-2014
The package php before version 5.6.4-1 is suffering from a use after
free flaw leading to denial of service and possibly arbitrary code
Upgrade to 5.6.4-1.
# pacman -Syu "php>=5.6.4-1"
The problem has been fixed in version 5.6.4.
A use-after-free flaw was found in PHP unserialize(). An untrusted input
could cause PHP interpreter to crash or, possibly, execute arbitrary
code when processed using unserialize().
A remote attacker able to pass crafted data to the unserialize function
is able to force a crash or possibly execute arbitrary code.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security