CVE-2014-9425

Published Dec 31, 2014 php

Overview

CVE-2014-9425 is a known-severity vulnerability affecting php php. It was published on December 31, 2014.

Technical Description

Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Remediation

Check the references section for vendor advisories and patches from php. Update php to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
php	php	0	Affected
apple	mac_os_x	0	Affected

References

Ref advisories.mageia.org/MGASA-2015-0040.html Ref git.php.net/?p=php-src.git%3Ba=commit%3Bh=24125f0f26f3787c006e4a51611ba33ee3b841cb Ref git.php.net/?p=php-src.git%3Ba=commit%3Bh=2bcf69d073190e4f032d883f3416dea1b027a39e Ref git.php.net/?p=php-src.git%3Ba=commit%3Bh=fbf3a6bc1abcc8a5b5226b0ad9464c37f11ddbd6 Ref lists.apple.com/archives/security-announce/2015/Sep/msg00008.html Ref openwall.com/lists/oss-security/2014/12/29/6 Ref rhn.redhat.com/errata/RHSA-2015-1218.html Ref www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html Ref www.securityfocus.com/bid/71800 Ref bugs.php.net/bug.php?id=68676

Frequently Asked Questions

What is CVE-2014-9425?

CVE-2014-9425 is a known-severity vulnerability affecting php php. It was published on December 31, 2014.

How severe is CVE-2014-9425?

CVSS score information is not yet available for this vulnerability. Check back as the CVE record is updated by NVD analysts.

How do I fix or remediate CVE-2014-9425?

How can CyberStrike help with CVE-2014-9425?

CyberStrike's AI-powered security agents can automatically detect CVE-2014-9425 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.