{"api_version":"1","generated_at":"2026-07-23T06:37:24+00:00","cve":"CVE-2014-3515","urls":{"html":"https://cve.report/CVE-2014-3515","api":"https://cve.report/api/cve/CVE-2014-3515.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-3515","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3515"},"summary":{"title":"CVE-2014-3515","description":"The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to \"type confusion\" issues in (1) ArrayObject and (2) SPLObjectStorage.","state":"PUBLISHED","assigner":"redhat","published_at":"2014-07-09 11:07:01","updated_at":"2026-05-06 22:30:45"},"problem_types":["NVD-CWE-noinfo","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21683486","name":"http://www-01.ibm.com/support/docview.wss?uid=swg21683486","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"IBM Security Bulletin: Multiple vulnerabilities in PHP 5.2 open source component for IBM Lotus Protector for Mail Security (CVE-2014-3515 CVE-2014-4049 CVE-2014-3981 CVE-2014-0238 CVE-2014-0237, CVE-2014-4721, CVE-2014-4670 CVE-2014-4698) - United States","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1765.html","name":"http://rhn.redhat.com/errata/RHSA-2014-1765.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html","name":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"openSUSE-SU-2014:1236-1: moderate: several security fixes for php5","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugs.php.net/bug.php?id=67492","name":"https://bugs.php.net/bug.php?id=67492","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"PHP :: Sec Bug #67492 :: unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.php.net/ChangeLog-5.php","name":"http://www.php.net/ChangeLog-5.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"PHP: PHP 5 ChangeLog","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://support.apple.com/kb/HT6443","name":"http://support.apple.com/kb/HT6443","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"About the security content of OS X Mavericks v10.9.5 and Security Update 2014-004 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","name":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Oracle Bulletin Board Update - January 2015","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/60998","name":"http://secunia.com/advisories/60998","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Security Advisory SA60998 - IBM Lotus Protector for Mail Security PHP Multiple Vulnerabilities - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=88223c5245e9b470e1e6362bfd96829562ffe6ab","name":"http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=88223c5245e9b470e1e6362bfd96829562ffe6ab","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"208.43.231.11 Git - php-src.git/commit","mime":"text/xml","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.debian.org/security/2014/dsa-2974","name":"http://www.debian.org/security/2014/dsa-2974","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Debian -- Security Information -- DSA-2974-1 php5","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1766.html","name":"http://rhn.redhat.com/errata/RHSA-2014-1766.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://secunia.com/advisories/59794","name":"http://secunia.com/advisories/59794","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/68237","name":"http://www.securityfocus.com/bid/68237","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"PHP unserialize() Function Type Confusion Security Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/59831","name":"http://secunia.com/advisories/59831","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=141017844705317&w=2","name":"http://marc.info/?l=bugtraq&m=141017844705317&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"'[security bulletin] HPSBUX03102 SSRT101681 rev.1 - HP-UX Apache Server Suite running Apache Tomcat o' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://git.php.net/?p=php-src.git;a=commit;h=88223c5245e9b470e1e6362bfd96829562ffe6ab","name":"CONFIRM:http://git.php.net/?p=php-src.git;a=commit;h=88223c5245e9b470e1e6362bfd96829562ffe6ab","refsource":"MITRE","tags":[],"title":"208.43.231.11 Git - php-src.git/commit","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3515","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3515","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"3515","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"php","cpe5":"php","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T10:43:06.284Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=88223c5245e9b470e1e6362bfd96829562ffe6ab"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21683486"},{"name":"RHSA-2014:1766","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1766.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugs.php.net/bug.php?id=67492"},{"name":"HPSBUX03102","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=141017844705317&w=2"},{"name":"DSA-2974","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2014/dsa-2974"},{"name":"59794","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/59794"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.php.net/ChangeLog-5.php"},{"name":"60998","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/60998"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://support.apple.com/kb/HT6443"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"},{"name":"RHSA-2014:1765","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1765.html"},{"name":"SSRT101681","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=141017844705317&w=2"},{"name":"68237","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/68237"},{"name":"59831","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/59831"},{"name":"openSUSE-SU-2014:1236","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-06-26T00:00:00.000Z","descriptions":[{"lang":"en","value":"The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to \"type confusion\" issues in (1) ArrayObject and (2) SPLObjectStorage."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-01-04T17:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=88223c5245e9b470e1e6362bfd96829562ffe6ab"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21683486"},{"name":"RHSA-2014:1766","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1766.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugs.php.net/bug.php?id=67492"},{"name":"HPSBUX03102","tags":["vendor-advisory","x_refsource_HP"],"url":"http://marc.info/?l=bugtraq&m=141017844705317&w=2"},{"name":"DSA-2974","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2014/dsa-2974"},{"name":"59794","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/59794"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.php.net/ChangeLog-5.php"},{"name":"60998","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/60998"},{"tags":["x_refsource_CONFIRM"],"url":"http://support.apple.com/kb/HT6443"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"},{"name":"RHSA-2014:1765","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1765.html"},{"name":"SSRT101681","tags":["vendor-advisory","x_refsource_HP"],"url":"http://marc.info/?l=bugtraq&m=141017844705317&w=2"},{"name":"68237","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/68237"},{"name":"59831","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/59831"},{"name":"openSUSE-SU-2014:1236","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secalert@redhat.com","ID":"CVE-2014-3515","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to \"type confusion\" issues in (1) ArrayObject and (2) SPLObjectStorage."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://git.php.net/?p=php-src.git;a=commit;h=88223c5245e9b470e1e6362bfd96829562ffe6ab","refsource":"CONFIRM","url":"http://git.php.net/?p=php-src.git;a=commit;h=88223c5245e9b470e1e6362bfd96829562ffe6ab"},{"name":"http://www-01.ibm.com/support/docview.wss?uid=swg21683486","refsource":"CONFIRM","url":"http://www-01.ibm.com/support/docview.wss?uid=swg21683486"},{"name":"RHSA-2014:1766","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2014-1766.html"},{"name":"https://bugs.php.net/bug.php?id=67492","refsource":"CONFIRM","url":"https://bugs.php.net/bug.php?id=67492"},{"name":"HPSBUX03102","refsource":"HP","url":"http://marc.info/?l=bugtraq&m=141017844705317&w=2"},{"name":"DSA-2974","refsource":"DEBIAN","url":"http://www.debian.org/security/2014/dsa-2974"},{"name":"59794","refsource":"SECUNIA","url":"http://secunia.com/advisories/59794"},{"name":"http://www.php.net/ChangeLog-5.php","refsource":"CONFIRM","url":"http://www.php.net/ChangeLog-5.php"},{"name":"60998","refsource":"SECUNIA","url":"http://secunia.com/advisories/60998"},{"name":"http://support.apple.com/kb/HT6443","refsource":"CONFIRM","url":"http://support.apple.com/kb/HT6443"},{"name":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","refsource":"CONFIRM","url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"},{"name":"RHSA-2014:1765","refsource":"REDHAT","url":"http://rhn.redhat.com/errata/RHSA-2014-1765.html"},{"name":"SSRT101681","refsource":"HP","url":"http://marc.info/?l=bugtraq&m=141017844705317&w=2"},{"name":"68237","refsource":"BID","url":"http://www.securityfocus.com/bid/68237"},{"name":"59831","refsource":"SECUNIA","url":"http://secunia.com/advisories/59831"},{"name":"openSUSE-SU-2014:1236","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html"}]}}}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2014-3515","datePublished":"2014-07-09T10:00:00.000Z","dateReserved":"2014-05-14T00:00:00.000Z","dateUpdated":"2024-08-06T10:43:06.284Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-07-09 11:07:01","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["NVD-CWE-noinfo","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionEndExcluding":"5.3.29","matchCriteriaId":"388E0CDF-737F-437E-B4D9-1001E0651387"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.0","versionEndExcluding":"5.4.30","matchCriteriaId":"AD052020-AA37-4F49-A0FE-EA99616C12C7"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5.0","versionEndExcluding":"5.5.14","matchCriteriaId":"4ADC6057-9D35-4D87-B15D-F6F52A283464"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"16F59A04-14CF-49E2-9973-645477EA09DA"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"3515","Ordinal":"1","Title":"CVE-2014-3515","CVE":"CVE-2014-3515","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"3515","Ordinal":"1","NoteData":"The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to \"type confusion\" issues in (1) ArrayObject and (2) SPLObjectStorage.","Type":"Description","Title":"CVE-2014-3515"},{"CveYear":"2014","CveId":"3515","Ordinal":"2","NoteData":"2014-07-09","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"3515","Ordinal":"3","NoteData":"2017-01-04","Type":"Other","Title":"Modified"}]}}}