CVE-2014-4698

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-10 · updated 2026-06-17

Description

Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments.

Affected products

PHP: from 5.4.0 before 5.4.32; from 5.5.0 before 5.5.15 — fixed in 5.4.32, 5.5.15

How to fix

Upgrade to a fixed version: PHP 5.4.32, 5.5.15. Check the vendor advisory for mitigations.

References

http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
http://lists.opensuse.org/opensuse-updates/2014-07/msg00035.html
http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html
http://rhn.redhat.com/errata/RHSA-2014-1326.html
http://rhn.redhat.com/errata/RHSA-2014-1327.html
http://rhn.redhat.com/errata/RHSA-2014-1765.html
http://rhn.redhat.com/errata/RHSA-2014-1766.html
http://secunia.com/advisories/54553
http://secunia.com/advisories/59831
http://www-01.ibm.com/support/docview.wss?uid=swg21683486
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
https://bugs.php.net/bug.php?id=67539

Get alerted when CVE-2014-4698 or the next vulnerability affects your stack