CVE-2014-8626

PHP < 5.2.7 - Stack-Based Buffer Overflow in date_from_ISO8601

Title source: llm
STIX 2.1

Description

Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.

References (8)

Core 8
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1824.html
Exploit x_refsource_confirm
https://bugs.php.net/bug.php?id=45226
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1825.html
Various Sources x_refsource_confirm
http://php.net/ChangeLog-5.php
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1155607
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/70928
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2014/11/06/3

Scores

EPSS 0.0395
EPSS Percentile 88.5%

Details

CWE
CWE-119
Status published
Products (7)
php/php 5.2.0
php/php 5.2.1
php/php 5.2.2
php/php 5.2.3
php/php 5.2.4
php/php 5.2.5
php/php < 5.2.6
Published Nov 23, 2014
Tracked Since Feb 18, 2026