5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.157 Low
EPSS
Percentile
95.8%
Package : file
Version : 5.04-5+squeeze6
CVE ID : CVE-2014-0207 CVE-2014-0237 CVE-2014-0238 CVE-2014-3478
CVE-2014-3479 CVE-2014-3480 CVE-2014-3487
Fix various denial of service attacks:
CVE-2014-3487
The cdf_read_property_info function does not properly validate a stream
offset, which allows remote attackers to cause a denial of service
(application crash) via a crafted CDF file.
CVE-2014-3480
The cdf_count_chain function in cdf.c in does not properly validate
sector-count data, which allows remote attackers to cause a denial of
service
(application crash) via a crafted CDF file.
CVE-2014-3479
The cdf_check_stream_offset function in cdf.c relies on incorrect
sector-size data, which allows remote attackers to cause a denial of service
(application crash) via a crafted stream offset in a CDF file.
CVE-2014-3478
Buffer overflow in the mconvert function in softmagic.c allows remote
attackers to cause a denial of service (application crash) via a crafted
Pascal string in a FILE_PSTRING conversion.
CVE-2014-0238
The cdf_read_property_info function in cdf.c allows remote attackers to
cause a denial of service (infinite loop or out-of-bounds memory access) via
a vector that (1) has zero length or (2) is too long.
CVE-2014-0237
The cdf_unpack_summary_info function in cdf.c allows remote attackers to
cause a denial of service (performance degradation) by triggering many
file_printf calls.
CVE-2014-0207
The cdf_read_short_sector function in cdf.c allows remote attackers to
cause a denial of service (assertion failure and application exit) via a
crafted CDF file.
Attachment:
signature.asc
Description: This is a digitally signed message part.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 7 | mips | php5-intl | < 5.4.4-14+deb7u12 | php5-intl_5.4.4-14+deb7u12_mips.deb |
Debian | 7 | i386 | php5-curl | < 5.4.4-14+deb7u12 | php5-curl_5.4.4-14+deb7u12_i386.deb |
Debian | 7 | amd64 | php5-cgi | < 5.4.4-14+deb7u12 | php5-cgi_5.4.4-14+deb7u12_amd64.deb |
Debian | 7 | powerpc | php5-mcrypt | < 5.4.4-14+deb7u12 | php5-mcrypt_5.4.4-14+deb7u12_powerpc.deb |
Debian | 7 | i386 | php5-pgsql | < 5.4.4-14+deb7u12 | php5-pgsql_5.4.4-14+deb7u12_i386.deb |
Debian | 7 | i386 | php5-snmp | < 5.4.4-14+deb7u12 | php5-snmp_5.4.4-14+deb7u12_i386.deb |
Debian | 7 | mips | python-magic | < 5.11-2+deb7u4 | python-magic_5.11-2+deb7u4_mips.deb |
Debian | 7 | amd64 | php5-xmlrpc | < 5.4.4-14+deb7u12 | php5-xmlrpc_5.4.4-14+deb7u12_amd64.deb |
Debian | 7 | powerpc | php5-sqlite | < 5.4.4-14+deb7u12 | php5-sqlite_5.4.4-14+deb7u12_powerpc.deb |
Debian | 7 | armel | python-magic | < 5.11-2+deb7u4 | python-magic_5.11-2+deb7u4_armel.deb |