Description

Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value.

Remediation

References

CVE-2014-3669

Related Vulnerabilities

WordPress Plugin GiveWP-Donation and Fundraising Platform Cross-Site Scripting (2.10.3)

Serendipity Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-1000129)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3757)

Apache Tomcat Other Vulnerability (CVE-2011-1419)

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-16197)

Severity

High

Classification

CVE-2014-3669

Tags

Missing Update Known Vulnerabilities