CVE-2014-8142
Highphp: use after free vulnerability in unserialize()
Published Dec 18, 2014 · Updated Apr 22, 2026 · Also known as DEBIAN-CVE-2014-8142, DEBIAN-CVE-2014-9427, DSA-3117-1, SUSE-SU-2015:0365-1, UBUNTU-CVE-2014-8142, USN-2501-1
Key Facts
Patch immediately- CVE-2014-8142 is a high-severity vulnerability (CVSS 7.5 v2) affecting PHP, php5 (debian), php54-bcmath (amazon) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 53% probability of exploitation in the next 30 days.
- Fixed versions are available, including apache2-mod_php5 5.5.14-11.3, apache2-mod_php53 5.3.17-0.31.1, apache2-mod_php53 5.3.17-47.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
53%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2014-8142 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019.
Affected Products
497 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| PHPPHP | 5.5.0, 5.5.0-alpha1, 5.5.0-alpha2, 5.5.0-alpha3, 5.5.0-alpha4, 5.5.0-alpha5, 5.5.0-alpha6, 5.5.0-beta1 | 5.4.35 |
| php5debian | See advisory | 5.4.36-0+deb7u1 |
| php54-bcmathamazon | See advisory | 5.4.36-1.64.amzn1 |
| php54-cliamazon | See advisory | 5.4.36-1.64.amzn1 |
| php54-commonamazon | See advisory | 5.4.36-1.64.amzn1 |
Patched Releases
apache2-mod_php5
5.5.14-11.3
apache2-mod_php53
5.3.17-0.31.1, 5.3.17-47.1
PHP
0:5.4.16-36.ael7b_1, 5.4.16-36.el7_1, 5.4.35
php-bcmath
5.4.16-36.el7_1
php-cli
5.4.16-36.el7_1
php-common
5.4.16-36.el7_1
php-dba
5.4.16-36.el7_1
php-devel
5.4.16-36.el7_1
php-embedded
5.4.16-36.el7_1
php-enchant
5.4.16-36.el7_1
php-fpm
5.4.16-36.el7_1
php-gd
5.4.16-36.el7_1
php-intl
5.4.16-36.el7_1
php-ldap
5.4.16-36.el7_1
php-mbstring
5.4.16-36.el7_1
php-mysql
5.4.16-36.el7_1
php-mysqlnd
5.4.16-36.el7_1
php-odbc
5.4.16-36.el7_1
php-pdo
5.4.16-36.el7_1
php-pgsql
5.4.16-36.el7_1
php-process
5.4.16-36.el7_1
php-pspell
5.4.16-36.el7_1
php-recode
5.4.16-36.el7_1
php-snmp
5.4.16-36.el7_1
php-soap
5.4.16-36.el7_1
Timeline
Publicly disclosed
Dec 18, 2014
Last updated
Apr 22, 2026
Weakness Type
- CWE-416 Use After Free
References
- advisoryhttp://php.net/ChangeLog-5.php
- advisoryRHSA-2015:1053
- advisoryRHSA-2015:1066
- advisoryRHSA-2015:1135
- advisoryhttps://bugzilla.suse.com/884986
FAQ
Common Questions.
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialize…
Affected: PHP versions 5.5.0, 5.5.0-alpha1, 5.5.0-alpha2, 5.5.0-alpha3, 5.5.0-alpha4, 5.5.0-alpha5, 5.5.0-alpha6, 5.5.0-beta1; php5 (debian); php54-bcmath (amazon), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including apache2-mod_php5 5.5.14-11.3, apache2-mod_php53 5.3.17-0.31.1, apache2-mod_php53 5.3.17-47.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2014-8142 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo