Every CVESearch/Get API key

CVE-2014-8626

Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in...

7.5 HighFix available

CVE-2014-8626 is a high vulnerability (CVSS 7.5) in Php, published November 23, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.78%, the 93rd percentile. Fixed in php 0:4.3.9-3.38.el4.

What does this mean?
Severity
7.5 HighCVSS 2.0, NVD
Exploit chance
5.78%EPSS, 93rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0:4.3.9-3.38.el4php +69 more

Description

Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.

Exploit likelihood

5.78%Up 0.3 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-bcmath
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-cli
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-common
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-dba
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-gd
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-imap
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-ldap
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
Show 60 moreShow less
Affected packages
PackageAffectedFixed
php-mbstring
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-mysql
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-ncurses
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-odbc
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-pdo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-pgsql
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-snmp
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-soap
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-xml
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-xmlrpc
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-bcmath
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-cli
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-common
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-dba
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-gd
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-imap
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-ldap
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-mbstring
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-mysql
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-ncurses
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-odbc
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-pdo
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-pgsql
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-snmp
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-soap
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-xml
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php-xmlrpc
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:5.1.6-45.el5_11
0:5.1.6-45.el5_11
php
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-debuginfo
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-devel
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-domxml
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-gd
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-imap
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-ldap
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-mbstring
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-mysql
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-ncurses
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-odbc
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-pear
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-pgsql
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-snmp
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-xmlrpc
Red Hat:rhel_els:4::as
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-debuginfo
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-devel
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-domxml
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-gd
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-imap
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-ldap
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-mbstring
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-mysql
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-ncurses
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-odbc
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-pear
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-pgsql
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-snmp
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4
php-xmlrpc
Red Hat:rhel_els:4::es
before 0:4.3.9-3.38.el4
0:4.3.9-3.38.el4

What each source reports

NVD Score used7.5

Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.

Record
CVE-2014-8626
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE ListNo score

Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.

Record
CVE-2014-8626
Updated
2026-11-02
EUVDEUVD-2014-8463No score

Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.

Record
EUVD-2014-8463
Updated
2026-11-03
GitHub AdvisoriesGHSA-mfxw-8c28-qhqcNo score

Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in...

Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.

Record
GHSA-mfxw-8c28-qhqc
Weakness
CWE-119
Updated
2026-11-02
OSVBELL-CVE-2014-86267.5

CVE-2014-8626 does not affect BellSoft software

Record
BELL-CVE-2014-8626
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 21 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open