CVE-2014-4049: debian debian_linux

Modified

AliasesUBUNTU-CVE-2014-4049DLA-0010-1DSA-2961-1

Published 18-06-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-4049 is a medium (CVSS 5.1) vulnerability in debian debian_linux. EPSS estimates a 10.91% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.1/10

010

Medium · v2.0 (NVD)

EPSS score

10.91%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 5

MGASA-2014-0283 MGASA-2014-0284 OPENSUSE-SU-2024:10290-1 OPENSUSE-SU-2024:10344-1 OPENSUSE-SU-2024:11169-1 RHSA-2014:1012+5 more

Timeline

18-06-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.

CVSS metrics

1 score · 1 source · 1 version

v2.05.1

EPSS trend

Probability

10.91%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 10.91% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian2 products

php5< 5.3.3-7+squeeze20 | < 5.4.4-14+deb7u11
debian_linuxEOL7.0 | 8.0

Opensuse1 product

opensuseEOL11.3

Php1 product

phpEOL≥ 5.3.0, < 5.3.29 | ≥ 5.4.0, < 5.4.30 | ≥ 5.5.0, < 5.5.14 | 5.6.0:alpha1 | 5.6.0:alpha2 | 5.6.0:alpha3 | 5.6.0:alpha4 | 5.6.0:alpha5 | 5.6.0:beta1 | 5.6.0:beta2 | 5.6.0:beta3

Ubuntu1 product

php5< 5.5.9+dfsg-1ubuntu4.1

4 vendors · 5 products

References

28 links

secunia.com/advisories/59329Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2014-07/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/59418Third Party AdvisoryX Refsource SECUNIA
support.apple.com/HT204659X Refsource CONFIRMThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21683486X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/59496Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id/1030435VDB EntryX Refsource SECTRACKThird Party Advisory
rhn.redhat.com/errata/RHSA-2014-1766.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/59652Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/68007VDB EntryX Refsource BIDThird Party Advisory

Show all 28 references

secunia.com/advisories/59513Third Party AdvisoryX Refsource SECUNIA
marc.info?l=bugtraq&m=141017844705317&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2014-07/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/60998Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/59270Third Party AdvisoryX Refsource SECUNIA
lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
support.apple.com/kb/HT6443X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-updates/2014-06/msg00051.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1108447X Refsource CONFIRMIssue Tracking
www.debian.org/security/2014/dsa-2961Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlX Refsource CONFIRMThird Party Advisory
rhn.redhat.com/errata/RHSA-2014-1765.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
github.com/php/php-src/commit/b34d7849ed90ced9345f8ea1c59bc8d101c18468X Refsource CONFIRMPatchThird Party Advisory
www.openwall.com/lists/oss-security/2014/06/13/4Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
lists.opensuse.org/opensuse-updates/2014-07/msg00032.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
ubuntu.com/security/CVE-2014-4049REPORT
ubuntu.com/security/notices/USN-2254-1Advisory
www.cve.org/CVERecord?id=CVE-2014-4049REPORT