CVE-2014-3515

7.5

HIGHCVSS v2

Published

July 9, 2014

Affected

2 projects

Assigned by

Red Hat

Severity scale

010

Description

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.

php

NPMAllows you to run PHP code in Node.js in various ways.

= *, >= 5.5.0, < 5.5.14, >= 5.4.0, < 5.4.30, < 5.3.29NVD

php

Python Package IndexHandle some of the strange standards in PHP projects

= *, >= 5.5.0, < 5.5.14, >= 5.4.0, < 5.4.30, < 5.3.29NVD

More on this CVE

NVD↗GitHub Advisory↗

Security Advisories

CVE-2014-3515

Description

More on this CVE