CVE-2014-3981
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PHP（PHP：Hypertext Preprocessor，PHP：超文本预处理器）是PHP Group和开放源代码社区共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发，支持多种数据库及操作系统。 PHP 5.5.13及之前版本中的配置脚本使用的acinclude.m4文件存在安全漏洞。本地攻击者可通过对/tmp/phpglibccheck文件实施符号链接攻击利用该漏洞覆盖任意文件。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2014-3981
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
PHP 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PHP（PHP：Hypertext Preprocessor，PHP：超文本预处理器）是PHP Group和开放源代码社区共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发，支持多种数据库及操作系统。 PHP 5.5.13及之前版本中的配置脚本使用的acinclude.m4文件存在安全漏洞。本地攻击者可通过对/tmp/phpglibccheck文件实施符号链接攻击利用该漏洞覆盖任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2014-3981
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2014-3981
请登录查看更多情报信息。
Vendor Advisories for CVE-2014-3981 (4)
-
http://support.apple.com/kb/HT6443 x_refsource_CONFIRM
-
https://support.apple.com/HT204659 x_refsource_CONFIRM
-
http://www-01.ibm.com/support/docview.wss?uid=swg21683486 x_refsource_CONFIRM
-
https://bugzilla.redhat.com/show_bug.cgi?id=1104978 x_refsource_CONFIRM
Mailing List Discussions for CVE-2014-3981 (5)
-
-
-
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html vendor-advisory x_refsource_APPLE
-
-
Other References for CVE-2014-3981 (3)
-
https://bugs.php.net/bug.php?id=67390 x_refsource_CONFIRM
-
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html x_refsource_CONFIRM
Same Patch Batch · n/a · 2014-06-08 · 17 CVEs total
| CVE-2014-0929 | IBM Connections 跨站请求伪造漏洞 | |
| CVE-2014-0936 | IBM Security AppScan Source 提权漏洞 | |
| CVE-2014-3036 | IBM API Management 安全漏洞 | |
| CVE-2014-3038 | IBM SPSS Modeler 安全漏洞 | |
| CVE-2014-3048 | IBM System Storage Virtualization Engine TS7700 安全漏洞 | |
| CVE-2014-3977 | IBM AIX和VIOS 安全漏洞 | |
| CVE-2014-0961 | IBM Tivoli Identity Manager和IBM Security Identity Manager 跨站请求伪造漏洞 | |
| CVE-2014-3982 | Lynis 后置链接漏洞 | |
| CVE-2014-3986 | Lynis 安全漏洞 | |
| CVE-2014-3278 | Cisco Unified Communications Domain Manager 安全漏洞 | |
| CVE-2014-3281 | Cisco Unified Communications Domain Manager 安全漏洞 | |
| CVE-2014-3286 | Cisco WebEx Meeting Server 安全漏洞 | |
| CVE-2014-3291 | Cisco Wireless LAN Controller 安全漏洞 | |
| CVE-2014-2506 | EMC Documentum Content Server 提权漏洞 | |
| CVE-2014-2507 | EMC Documentum Content Server 命令注入漏洞 | |
| CVE-2014-2508 | EMC Documentum Content Server 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2014-3981
No comments yet