CVE-2014-3478

Description

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

References

https://support.apple.com/HT204659

https://bugs.php.net/bug.php?id=67410

http://www.securityfocus.com/bid/68239

http://www.php.net/ChangeLog-5.php

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html

http://www.debian.org/security/2014/dsa-3021

http://www.debian.org/security/2014/dsa-2974

http://support.apple.com/kb/HT6443

http://secunia.com/advisories/59831

http://secunia.com/advisories/59794

http://rhn.redhat.com/errata/RHSA-2014-1766.html

http://rhn.redhat.com/errata/RHSA-2014-1765.html

http://rhn.redhat.com/errata/RHSA-2014-1327.html

http://mx.gw.com/pipermail/file/2014/001553.html

http://marc.info/?l=bugtraq&m=141017844705317&w=2

http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html

http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3