CVE-2014-3622 Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filt...
CriticalCVSS 9.8
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | >= 5.6.0, < 5.6.1 | 5.6.1 |
| PHP | = 5.6.x before 5.6.1 | No fix listed |
References
- php.net release-notes vendor-advisory
- bugs.php.net exploit vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory