CVE-2014-4670: php
Vulnerability summary
CVE-2014-4670 is a medium (CVSS 4.6) vulnerability in php. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 53.5% of scored vulnerabilities.
Not severe (CVSS 4.6, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 5Timeline
- 10-07-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.71% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.
Php1 product
- phpEOL≤ 5.5.14 | 5.5.0 | 5.5.0:alpha1 | 5.5.0:alpha2 | 5.5.0:alpha3 | 5.5.0:alpha4 | 5.5.0:alpha5 | 5.5.0:alpha6 | 5.5.0:beta1 | 5.5.0:beta2 | 5.5.0:beta3 | 5.5.0:beta4 | 5.5.0:rc1 | 5.5.0:rc2 | 5.5.1 | 5.5.2 | 5.5.3 | 5.5.4 | 5.5.5 | 5.5.6 | 5.5.7 | 5.5.8 | 5.5.9 | 5.5.10 | 5.5.11 | 5.5.12 | 5.5.13
Ubuntu1 product
- php5< 5.5.9+dfsg-1ubuntu4.3
2 vendors · 2 products
References
18 links- support.apple.com/HT204659X Refsource CONFIRM
- www-01.ibm.com/support/docview.wss?uid=swg21683486X Refsource CONFIRM
- bugs.php.net/bug.php?id=67538X Refsource CONFIRM
Show all 18 references
- www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlX Refsource CONFIRM