CVE-2014-3478

2014-07-0911:07:00

CWE-119

[email protected]

web.nvd.nist.gov

140

cve-2014-3478

buffer overflow

mconvert function

softmagic.c

denial of service

nvd

security vulnerability

php

6.6 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.157 Low

EPSS

Percentile

95.9%

JSON

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

CPENameOperatorVersion
christos_zoulas:filechristos zoulas fileeq5.00
christos_zoulas:filechristos zoulas fileeq5.04
php:phpphpeq5.5.0
christos_zoulas:filechristos zoulas fileeq5.10
php:phpphpeq5.4.12
php:phpphpeq5.4.15
christos_zoulas:filechristos zoulas fileeq5.07
php:phpphpeq5.4.19
php:phpphpeq5.5.1
christos_zoulas:filechristos zoulas fileeq5.02

CPE	Name	Operator	Version
christos_zoulas:file	christos zoulas file	eq	5.00
christos_zoulas:file	christos zoulas file	eq	5.04
php:php	php	eq	5.5.0
christos_zoulas:file	christos zoulas file	eq	5.10
php:php	php	eq	5.4.12
php:php	php	eq	5.4.15
christos_zoulas:file	christos zoulas file	eq	5.07
php:php	php	eq	5.4.19
php:php	php	eq	5.5.1
christos_zoulas:file	christos zoulas file	eq	5.02