CVE-2014-3981
Summary
| CVE | CVE-2014-3981 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-06-08 18:55:06 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
PartialAV:L/AC:M/Au:N/C:N/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM Security Bulletin: Multiple vulnerabilities in PHP 5.2 open source component for IBM Lotus Protector for Mail Security (CVE-2014-3515 CVE-2014-4049 CVE-2014-3981 CVE-2014-0238 CVE-2014-0237, CVE-2014-4721, CVE-2014-4670 CVE-2014-4698) - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Third Party Advisory |
| Full Disclosure: More /tmp fun (PHP, Lynis) | af854a3a-2127-422b-91ae-364da2661108 | seclists.org | Mailing List, Third Party Advisory |
| '[security bulletin] HPSBUX03150 SSRT101681 rev.1 - HP-UX Apache Server Suite running Apache Tomcat o' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List, Third Party Advisory |
| About the security content of OS X Yosemite v10.10.3 and Security Update 2015-004 - Apple Support | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Third Party Advisory |
| About the security content of OS X Mavericks v10.9.5 and Security Update 2014-004 - Apple Support | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Third Party Advisory |
| Oracle Bulletin Board Update - January 2015 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Third Party Advisory |
| APPLE-SA-2015-04-08-2 OS X 10.10.3 and Security Update 2015-004 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Mailing List |
| oss-security - Re: CVE request: PHP configure script and Lynis tool /tmp/ issues reported on full disclosure | af854a3a-2127-422b-91ae-364da2661108 | openwall.com | Mailing List, Third Party Advisory |
| Bug 1104978 – CVE-2014-3981 php: insecure temporary file use in the configure script | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking, Third Party Advisory |
| 208.43.231.11 Git - php-src.git/commit | af854a3a-2127-422b-91ae-364da2661108 | git.php.net | |
| '[security bulletin] HPSBUX03102 SSRT101681 rev.1 - HP-UX Apache Server Suite running Apache Tomcat o' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | Mailing List, Third Party Advisory |
| PHP :: Sec Bug #67390 :: insecure temporary file use in the configure script | af854a3a-2127-422b-91ae-364da2661108 | bugs.php.net | Patch, Vendor Advisory |
| 208.43.231.11 Git - php-src.git/commit | MITRE | git.php.net | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.