CVE-2014-3515

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after…

published July 9, 2014

CVSS

—

EPSS

30%

Percentile

98.2

In the wild

Unconfirmed

What it is

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.30128 · 98.2th percentile
Published: 2014-07-09T10:00Z

EPSS history

Timeline

09 JUL 10:00Z
The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after…
cvelistv5