PHP "Unserialize()" Security Vulnerability

Source: Linux Community Author: Linux Affected systems: PHP PHP < 5.4.36 Description: CVE(CAN) ID: CVE-2014-8142 PHP is a widely used general-purpose scripting language, especially well suited to web development, and can be embedded in HTML. In versions of PHP before 5.4.36, the “process_nested_data()” function has a use-after-free vulnerability in its implementation; an attacker can exploit it by passing crafted input to the “unserialize()” function to corrupt memory. The “var_push_dtor()” function has a null pointer dereference vulnerability in its implementation; an attacker can exploit it by passing crafted input to the “unserialize()” function to cause a crash. Successful exploitation of these vulnerabilities can result in arbitrary code execution. <Source: Stefan Esser Link: http://secunia.com/advisories/61236/ > Recommendation: Vendor patch: PHP —- The vendor has already released an upgrade patch to fix this security issue; please download it from the vendor’s homepage: PHP: http://php.net/ChangeLog-5.php#5.4.36 https://bugs.php.net/bug.php?id=68594 Charlie Eriksen: https://bugs.php.net/bug.php?id=68545 CentOS 6.3 installing LNMP (PHP 5.4, MyySQL5.6) http://www.linuxidc.com/Linux/2013-04/82069.htm Two problems with Nginx failing to start when deploying LNMP http://www.linuxidc.com/Linux/2013-03/81120.htm Ubuntu installing Nginx, php5-fpm, MySQL (setting up an LNMP environment) http://www.linuxidc.com/Linux/2012-10/72458.htm