Deskripsi CVE

Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049.

Informasi CVE

Kelemahan Terkait

CWE-ID	Nama Kelemahan	Sumber
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Metrik

Metrik	Skor	Tingkat keparahan	CVSS Vektor	Sumber
V2	6.8		AV:N/AC:M/Au:N/C:P/I:P/A:P	nvd@nist.gov

EPSS

EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.

Skor EPSS

Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.

Persentil EPSS

Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.

EPSS First.org

Produk yang Disebutkan

Konfigurasi 0

Php>>Php >> Version Hingga (termasuk) 5.4.31

Php>>Php >> Version 5.4.0

Php>>Php >> Version 5.4.1

Php>>Php >> Version 5.4.2

Php>>Php >> Version 5.4.3

Php>>Php >> Version 5.4.4

Php>>Php >> Version 5.4.5

Php>>Php >> Version 5.4.6

Php>>Php >> Version 5.4.7

Php>>Php >> Version 5.4.8

Php>>Php >> Version 5.4.9

Php>>Php >> Version 5.4.10

Php>>Php >> Version 5.4.11

Php>>Php >> Version 5.4.12

Php>>Php >> Version 5.4.13

Php>>Php >> Version 5.4.14

Php>>Php >> Version 5.4.15

Php>>Php >> Version 5.4.16

Php>>Php >> Version 5.4.17

Php>>Php >> Version 5.4.18

Php>>Php >> Version 5.4.19

Php>>Php >> Version 5.4.20

Php>>Php >> Version 5.4.21

Php>>Php >> Version 5.4.22

Php>>Php >> Version 5.4.23

Php>>Php >> Version 5.4.24

Php>>Php >> Version 5.4.25

Php>>Php >> Version 5.4.26

Php>>Php >> Version 5.4.27

Php>>Php >> Version 5.4.28

Php>>Php >> Version 5.4.29

Php>>Php >> Version 5.4.30

Php>>Php >> Version 5.5.0

Php>>Php >> Version 5.5.1

Php>>Php >> Version 5.5.2

Php>>Php >> Version 5.5.3

Php>>Php >> Version 5.5.4

Php>>Php >> Version 5.5.5

Php>>Php >> Version 5.5.6

Php>>Php >> Version 5.5.7

Php>>Php >> Version 5.5.8

Php>>Php >> Version 5.5.9

Php>>Php >> Version 5.5.10

Php>>Php >> Version 5.5.11

Php>>Php >> Version 5.5.12

Php>>Php >> Version 5.5.13

Php>>Php >> Version 5.5.14

Php>>Php >> Version 5.5.15

Referensi

https://support.apple.com/HT204659
Tags : x_refsource_CONFIRM

http://rhn.redhat.com/errata/RHSA-2014-1766.html
Tags : vendor-advisory, x_refsource_REDHAT

http://secunia.com/advisories/60609
Tags : third-party-advisory, x_refsource_SECUNIA

http://www.ubuntu.com/usn/USN-2344-1
Tags : vendor-advisory, x_refsource_UBUNTU

http://php.net/ChangeLog-5.php
Tags : x_refsource_CONFIRM

http://lists.opensuse.org/opensuse-updates/2014-09/msg00055.html
Tags : vendor-advisory, x_refsource_SUSE

https://bugs.php.net/bug.php?id=67717
Tags : x_refsource_CONFIRM

http://rhn.redhat.com/errata/RHSA-2014-1326.html
Tags : vendor-advisory, x_refsource_REDHAT

http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
Tags : vendor-advisory, x_refsource_APPLE

http://www.securityfocus.com/bid/69322
Tags : vdb-entry, x_refsource_BID

http://www.debian.org/security/2014/dsa-3008
Tags : vendor-advisory, x_refsource_DEBIAN

http://rhn.redhat.com/errata/RHSA-2014-1327.html
Tags : vendor-advisory, x_refsource_REDHAT

http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
Tags : x_refsource_CONFIRM

http://rhn.redhat.com/errata/RHSA-2014-1765.html
Tags : vendor-advisory, x_refsource_REDHAT

https://github.com/php/php-src/commit/2fefae47716d501aec41c1102f3fd4531f070b05
Tags : x_refsource_CONFIRM

https://security-tracker.debian.org/tracker/CVE-2014-3597
Tags : x_refsource_CONFIRM

http://secunia.com/advisories/60696
Tags : third-party-advisory, x_refsource_SECUNIA

http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html
Tags : vendor-advisory, x_refsource_SUSE

Tanggal	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	4.23%	–	–
2022-03-20	–	–	4.23%	–	–
2022-04-03	–	–	4.23%	–	–
2022-06-26	–	–	4.23%	–	–
2023-03-12	–	–	–	5.66%	–
2023-04-30	–	–	–	3.81%	–
2023-09-17	–	–	–	3.04%	–
2024-02-11	–	–	–	3.04%	–
2024-02-18	–	–	–	2.8%	–
2024-06-02	–	–	–	2.8%	–
2024-06-02	–	–	–	2.8%	–
2024-12-22	–	–	–	2.8%	–
2025-01-19	–	–	–	2.8%	–
2025-02-02	–	–	–	2.8%	–
2025-02-02	–	–	–	2.8%	–
2025-03-18	–	–	–	–	12.03%
2025-04-12	–	–	–	–	12.16%
2025-04-14	–	–	–	–	4.57%
2025-04-15	–	–	–	–	12.16%
2025-04-16	–	–	–	–	4.57%
2025-04-22	–	–	–	–	12.16%
2025-05-01	–	–	–	–	4.57%
2025-05-04	–	–	–	–	12.16%
2025-05-05	–	–	–	–	12.44%
2025-05-06	–	–	–	–	12.44%
2025-05-15	–	–	–	–	9.56%
2025-06-01	–	–	–	–	5.91%
2025-06-06	–	–	–	–	9.56%
2025-07-01	–	–	–	–	5.91%
2025-07-05	–	–	–	–	9.56%
2025-07-07	–	–	–	–	5.57%
2025-07-30	–	–	–	–	3.21%
2025-08-01	–	–	–	–	2.64%
2025-08-05	–	–	–	–	3.21%
2025-08-12	–	–	–	–	3.21%
2025-08-13	–	–	–	–	3.21%
2025-08-19	–	–	–	–	3.21%
2025-08-20	–	–	–	–	3.21%
2025-10-01	–	–	–	–	5.04%
2025-10-04	–	–	–	–	5.57%
2025-10-27	–	–	–	–	3.21%
2025-10-28	–	–	–	–	5.57%
2025-11-01	–	–	–	–	5.04%
2025-11-04	–	–	–	–	5.57%
2025-11-18	–	–	–	–	5.57%
2025-11-21	–	–	–	–	5.57%
2025-12-01	–	–	–	–	5.04%
2025-12-04	–	–	–	–	5.57%
2025-12-27	–	–	–	–	3.21%
2025-12-28	–	–	–	–	5.57%
2026-01-01	–	–	–	–	5.04%
2026-01-04	–	–	–	–	5.57%
2026-03-01	–	–	–	–	5.04%
2026-03-08	–	–	–	–	5.57%
2026-05-31	–	–	–	–	6.96%

Tanggal	Persentil
2022-02-06	7%
2022-03-20	71%
2022-04-03	86%
2022-06-26	87%
2023-03-12	92%
2023-04-30	91%
2023-09-17	9%
2024-02-11	91%
2024-02-18	9%
2024-06-02	91%
2024-06-02	91%
2024-12-22	9%
2025-01-19	9%
2025-02-02	91%
2025-02-02	91%
2025-03-18	93%
2025-04-12	93%
2025-04-14	88%
2025-04-15	93%
2025-04-16	89%
2025-04-22	93%
2025-05-01	89%
2025-05-04	93%
2025-05-05	93%
2025-05-06	94%
2025-05-15	92%
2025-06-01	9%
2025-06-06	92%
2025-07-01	9%
2025-07-05	92%
2025-07-07	9%
2025-07-30	87%
2025-08-01	85%
2025-08-05	87%
2025-08-12	86%
2025-08-13	87%
2025-08-19	86%
2025-08-20	87%
2025-10-01	89%
2025-10-04	9%
2025-10-27	87%
2025-10-28	9%
2025-11-01	89%
2025-11-04	9%
2025-11-18	89%
2025-11-21	9%
2025-12-01	89%
2025-12-04	9%
2025-12-27	87%
2025-12-28	9%
2026-01-01	89%
2026-01-04	9%
2026-03-01	9%
2026-03-08	9%
2026-05-31	92%

CVE-2014-3597 : Detail

CVE-2014-3597