Bug #67539 [Asn->Csd]: ArrayIterator use-after-free due to object change during sorting

Edit report at https://bugs.php.net/bug.php?id=67539&edit=1 ID: 67539 Updated by: ab@php.net Reported by: research at insighti dot org Summary: ArrayIterator use-after-free due to object change during sorting -Status: Assigned +Status: Closed Type: Bug Package: SPL related Operating System: * PHP Version: Irrelevant Block user comment: N Private report: N New Comment: Automatic comment on behalf of laruence Revision: http://git.php.net/?p=php-src.git;a=commit;h=22882a9d89712ff2b6ebc20a689a89452bba4dcd Log: Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting) Previous Comments: ------------------------------------------------------------------------ [2014-07-15 14:42:57] research at insighti dot org Please use the assigned CVE-2014-4698. 5.5.15-RC1 is now out and CVE is missing. ------------------------------------------------------------------------ [2014-07-07 15:22:04] dmitry@php.net Automatic comment on behalf of laruence Revision: http://git.php.net/?p=php-src.git;a=commit;h=22882a9d89712ff2b6ebc20a689a89452bba4dcd Log: Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting) ------------------------------------------------------------------------ [2014-07-05 12:09:38] research at insighti dot org As per the other reported bug, same applies for this one: Please use CVE-2014-4698, the bug is in fact exploitable - not sure why was it made public before release of a patched version. It's not remotely exploitable, however, shared environments relying on PHP security features (open_basedir, safe_mode in older PHPs, disable_functions and similar) are affected. We're ready to provide PoC is needed. ------------------------------------------------------------------------ [2014-07-03 22:45:05] research at insighti dot org Please use CVE-2014-4698 for this issue. ------------------------------------------------------------------------ [2014-07-02 09:58:57] laruence@php.net Automatic comment on behalf of laruence Revision: http://git.php.net/?p=php-src.git;a=commit;h=22882a9d89712ff2b6ebc20a689a89452bba4dcd Log: Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting) ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=67539 -- Edit this bug report at https://bugs.php.net/bug.php?id=67539&edit=1