CVE-2014-0185: php Improper Privilege Management
Vulnerability summary
CVE-2014-0185 is a high (CVSS 7.2) Improper Privilege Management vulnerability in php. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 41.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 4Timeline
- 06-05-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
Decrease -0.02 pp
From 0.51% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundPhp Src
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.
Mageia9 products
- php< 5.4.28-1.mga3
- php-apc< 3.1.14-7.8.mga3
- php-gd-bundled< 5.4.28-1.mga3
- php-suhosin< 0.9.35-1.mga3
- php-timezonedb< 2014.3-1.mga3
Opensuse1 product
- froxlor&distro=openSUSE Tumbleweed< 0.9.38.4-1.1
Php1 product
- php≥ 5.3.0, < 5.3.28 | ≥ 5.4.0, < 5.4.28 | ≥ 5.5.0, < 5.5.12
Ubuntu1 product
- php5< 5.5.9+dfsg-1ubuntu4.1
4 vendors · 12 products
References
22 links- github.com/php/php-src/commit/35ceea928b12373a3b1e3eecdc32ed323223a40dX Refsource CONFIRMExploitPatchThird Party Advisory
- hoffmann-christian.info/files/php-fpm/0001-Fix-bug-67060-use-default-mode-of-660.patchX Refsource MISCPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2014/04/29/5Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
Show all 22 references
- lists.opensuse.org/opensuse-updates/2015-10/msg00012.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory