Servers and applications
CVE-2014-3669 Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the unserialize function that triggers calculation of a large length value.
Severity High 7.5
Published 29 Oct 2014
Last changed 17 Jun 2026
Added to UpHeron 14 Oct 2026
Sources NVD Affected software Software Affected versions PHPServers and applications · cpe:a:php:php Version 5.6.1 Version 5.6.0 Version 5.5.17 Version 5.5.16 All 70 release lines Every version up to 5.4.33 Version 5.4.0 Version 5.4.1 Version 5.4.2 Version 5.4.3 Version 5.4.4 Version 5.4.5 Version 5.4.6 Version 5.4.7 Version 5.4.8 Version 5.4.9 Version 5.4.10 Version 5.4.11 Version 5.4.12-rc1 Version 5.4.12-rc2 Version 5.4.12 Version 5.4.13-rc1 Version 5.4.13 Version 5.4.14-rc1 Version 5.4.14 Version 5.4.15-rc1 Version 5.4.16-rc1 Version 5.4.17 Version 5.4.18 Version 5.4.19 Version 5.4.20 Version 5.4.21 Version 5.4.22 Version 5.4.23 Version 5.4.24 Version 5.4.25 Version 5.4.26 Version 5.4.27 Version 5.4.28 Version 5.4.29 Version 5.4.30 Version 5.4.31 Version 5.4.32 Version 5.5.0-alpha1 Version 5.5.0-alpha2 Version 5.5.0-alpha3 Version 5.5.0-alpha4 Version 5.5.0-alpha5 Version 5.5.0-alpha6 Version 5.5.0-beta1 Version 5.5.0-beta2 Version 5.5.0-beta3 Version 5.5.0-beta4 Version 5.5.0-rc1 Version 5.5.0-rc2 Version 5.5.0 Version 5.5.1 Version 5.5.2 Version 5.5.3 Version 5.5.4 Version 5.5.5 Version 5.5.6 Version 5.5.7 Version 5.5.8 Version 5.5.9 Version 5.5.10 Version 5.5.11 Version 5.5.12 Version 5.5.13 Version 5.5.14 Version 5.5.15 Version 5.5.16 Version 5.5.17 Version 5.6.0 Version 5.6.1
References NVD https://nvd.nist.gov/vuln/detail/CVE-2014-3669 CVE.org https://www.cve.org/CVERecord?id=CVE-2014-3669