CVE-2014-4721

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.30 PHP versions 5.5.x prior to 5.5.14

Description The issue is related to a "type confusion" vulnerability in the phpinfo implementation, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values for the PHP AUTH PW, PHP AUTH TYPE, PHP AUTH USER, and PHP SELF variables. This could potentially be exploited in an Apache HTTP Server web-hosting environment with mod ssl and a PHP mod php, as demonstrated by reading a private SSL key.

Recommendations For PHP versions prior to 5.4.30, update to version 5.4.30 or later. For PHP versions 5.5.x prior to 5.5.14, update to version 5.5.14 or later. As a temporary workaround, consider restricting access to sensitive information in the phpinfo output until a patch is applied.