CVE-2014-9427 Information disclosure in n/a
Remote attackers can read sensitive memory or execute code via crafted PHP files in PHP CGI when mmap is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-9427?
CVE-2014-9427 is a high-severity vulnerability in Php Php, published on 3 Jan 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping.
Weakness: CWE-119
Which versions are affected by CVE-2014-9427?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2014-9427?
Upgrade to a fixed version.
Is CVE-2014-9427 being exploited?
There is no known exploitation of CVE-2014-9427 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-jv9r-h7r8-3459, UBUNTU-CVE-2014-9427.