Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

PHP can run attacker code via crafted unserialize

CVE-2014-8142 · published 11 years ago
Summary

Versions of PHP before 5.4.36, 5.5.20, and 5.6.4 have a flaw in how they handle certain data during unserialize operations. An attacker could send specially crafted data that causes the server to execute unwanted code. Update PHP to the latest version or apply the provided patches to protect your systems.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
php php <= 5.4.35
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.5.10
13 more version ranges
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Original advisory text
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to exe...
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
55% chance of attack within 30 days
Timeline
Published20 Dec 2014
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2014-8142 · NVD
Track software like this
Free during beta