CVE-2014-8626: php
Vulnerability summary
CVE-2014-8626 is a high (CVSS 7.5) vulnerability in php. EPSS estimates a 5.78% chance of exploitation in the next 30 days, higher than 93.1% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 23-11-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
5.78%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
No change 0.00 pp
From 5.78% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (bugs.php.net)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat15 products
- php< 0:4.3.9-3.38.el4
- php-debuginfo< 0:4.3.9-3.38.el4
- php-devel< 0:4.3.9-3.38.el4
- php-domxml< 0:4.3.9-3.38.el4
- php-gd< 0:4.3.9-3.38.el4
Php1 product
- phpEOL≤ 5.2.6 | 5.2.0 | 5.2.1 | 5.2.2 | 5.2.3 | 5.2.4 | 5.2.5
2 vendors · 16 products
References
14 links- php.net/ChangeLog-5.phpX Refsource CONFIRM
