PHP5 Remote Code Execution Vuilnerability
Last Update Date:
18 Jun 2014 12:34
Release Date:
18 Jun 2014
3228
Views
RISK: Medium Risk
TYPE: Servers - Web Servers
A vulnerability was identified in PHP, which causes a heap-based buffer overflow in the DNS TXT record parsing.
A malicious server or man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application uses dns_get_record() to perform a DNS query.
Impact
- Remote Code Execution
System / Technologies affected
- Stable distribution (wheezy) version prior to 5.4.4-14+deb7u11
- Testing distribution (jessie) version prior to 5.6.0~beta4+dfsg-3
- Unstable distribution (sid) version prior to 5.6.0~beta4+dfsg-3
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
- The vendor has issued a fix.
Stable distribution (wheezy) version 5.4.4-14+deb7u11
Testing distribution (jessie) version 5.6.0~beta4+dfsg-3
Unstable distribution (sid) version 5.6.0~beta4+dfsg-3
Vulnerability Identifier
Source
Related Link
Share with