CVE-2014-9425: Apple Mac OS X

High severity, CVSS 7.5. EPSS: 3.7% chance of exploitation in the next 30 days.

Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Affected products

• Apple Mac OS X: up to and including 10.10.5
• PHP PHP: up to and including 5.5.20; from 5.6.0, up to and including 5.6.4

Published 2014-12-31. Last modified 2026-06-17.