NVD

Id
36130  
Name
CVE-2014-9427  
Description
sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping"s length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-01-02  
Modified Date
2016-12-30  
Seq
2014-9427  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
184674 36130 CVE-2014-9427 http://advisories.mageia.org/MGASA-2015-0040.html  View
184675 36130 CVE-2014-9427 http://git.php.net/?p=php-src.git;a=commit;h=f9ad3086693fce680fbe246e4a45aa92edd2ac35  View
184676 36130 CVE-2014-9427 APPLE-SA-2015-09-30-3  View
184677 36130 CVE-2014-9427 SUSE-SU-2015:0365  View
184678 36130 CVE-2014-9427 openSUSE-SU-2015:0325  View
184679 36130 CVE-2014-9427 HPSBMU03380  View
184680 36130 CVE-2014-9427 HPSBMU03409  View
184681 36130 CVE-2014-9427 [oss-security] 20141231 Re: CVE Request: PHP: out of bounds read crashes php-cgi  View
184682 36130 CVE-2014-9427 [oss-security] 20141231 Re: CVE Request: PHP: out of bounds read crashes php-cgi  View
184683 36130 CVE-2014-9427 [oss-security] 20150103 Re: CVE Request: PHP: out of bounds read crashes php-cgi  View
184684 36130 CVE-2014-9427 RHSA-2015:1053  View
184685 36130 CVE-2014-9427 RHSA-2015:1066  View
184686 36130 CVE-2014-9427 MDVSA-2015:032  View
184687 36130 CVE-2014-9427 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html  View
184688 36130 CVE-2014-9427 71833  View
184689 36130 CVE-2014-9427 https://bugs.php.net/bug.php?id=68618  View
184690 36130 CVE-2014-9427 GLSA-201503-03  View
184691 36130 CVE-2014-9427 https://support.apple.com/HT205267  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
18614 JVNDB-2014-007489 PHP の CGI コンポーネントの sapi/cgi/cgi_main.c における php-cgi プロセスメモリから重要な情報を取得される脆弱性 PHP の CGI コンポーネントの sapi/cgi/cgi_main.c は、.php ファイルを読むにあたり mmap が使用される場合、# 文字で始まり、改行文字が欠落している不正なファイル処理の過程でマッピングの長さを適切に考慮しないため、out-of-bounds read の原因となり、(1) php-cgi プロセスメモリから重要な情報を取得される、または (2) 有効な PHP スクリプトがマッピングに隣接したメモリロケーションに存在する場合、予測不可能なコードの実行を誘発される脆弱性が存在します。 CVE-2014-9427 76720 CVE-2014-9427 36130 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007489.html 2014-12-30 2015-10-06 View