Unrated severityNVD Advisory· Published Jan 3, 2015· Updated Jun 17, 2026
CVE-2014-9427
CVE-2014-9427
Description
sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
211cpe:2.3:a:php:php:1.0:*:*:*:*:*:*:*+ 205 more
- cpe:2.3:a:php:php:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:2.0b10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.13:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.14:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.15:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.17:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.18:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:3.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.0:beta_4_patch1:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:4.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.13:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.14:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.15:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.16:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.17:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.13:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.14:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.15:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.16:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.17:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.18:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.19:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.20:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.21:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.22:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.23:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.24:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.25:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.26:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.27:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.28:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.12:rc1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.12:rc2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.13:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.13:rc1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.14:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.14:rc1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.15:rc1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.16:rc1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.17:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.18:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.19:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.20:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.21:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.22:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.23:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.24:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.25:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.26:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.27:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.28:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.29:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.30:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.34:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.35:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.4.36:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:*
- (no CPE)range: <=5.4.36, <=5.5.20, <=5.6.4
- osv-coords5 versionspkg:rpm/opensuse/php5&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/php7&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/php8&distro=openSUSE%20Tumbleweedpkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012
< 5.6.28-1.1+ 4 more
- (no CPE)range: < 5.6.28-1.1
- (no CPE)range: < 7.0.14-1.4
- (no CPE)range: < 8.0.11-1.1
- (no CPE)range: < 5.5.14-11.3
- (no CPE)range: < 5.5.14-11.3
Patches
Vulnerability mechanics
References
18- bugs.php.net/bug.phpnvdExploit
- advisories.mageia.org/MGASA-2015-0040.htmlnvd
- git.php.netnvd
- lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.htmlnvd
- lists.opensuse.org/opensuse-updates/2015-02/msg00079.htmlnvd
- marc.infonvd
- marc.infonvd
- openwall.com/lists/oss-security/2014/12/31/6nvd
- openwall.com/lists/oss-security/2015/01/01/1nvd
- openwall.com/lists/oss-security/2015/01/03/4nvd
- rhn.redhat.com/errata/RHSA-2015-1053.htmlnvd
- rhn.redhat.com/errata/RHSA-2015-1066.htmlnvd
- www.mandriva.com/security/advisoriesnvd
- www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlnvd
- www.securityfocus.com/bid/71833nvd
- security.gentoo.org/glsa/201503-03nvd
- support.apple.com/HT205267nvd
News mentions
0No linked articles in our index yet.