CVE-2014-4049: Debian Linux

Medium severity, CVSS 5.1. EPSS: 10.9% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.

Affected products

• Debian Debian Linux: version 7.0 only; version 8.0 only
• Opensuse Opensuse: version 11.3 only
• PHP PHP: from 5.3.0, before 5.3.29 (fixed in 5.3.29); from 5.4.0, before 5.4.30 (fixed in 5.4.30); from 5.5.0, before 5.5.14 (fixed in 5.5.14); version 5.6.0 only

Published 2014-06-18. Last modified 2026-06-17.