Lucene search

[email protected]NVD:CVE-2014-3587

HistoryAug 23, 2014 - 1:55 a.m.

CVE-2014-3587

2014-08-2301:55:01

CWE-189

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

AI Score

7.2

Confidence

High

EPSS

0.08

Percentile

94.3%

JSON

Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.

Affected configurations

NVD

Node

christos_zoulasfileRange≤5.19

christos_zoulasfileMatch5.00

christos_zoulasfileMatch5.01

christos_zoulasfileMatch5.02

christos_zoulasfileMatch5.03

christos_zoulasfileMatch5.04

christos_zoulasfileMatch5.05

christos_zoulasfileMatch5.06

christos_zoulasfileMatch5.07

christos_zoulasfileMatch5.08

christos_zoulasfileMatch5.09

christos_zoulasfileMatch5.10

christos_zoulasfileMatch5.11

christos_zoulasfileMatch5.12

christos_zoulasfileMatch5.13

christos_zoulasfileMatch5.14

christos_zoulasfileMatch5.15

christos_zoulasfileMatch5.16

christos_zoulasfileMatch5.17

christos_zoulasfileMatch5.18

phpphpRange≤5.4.31

phpphpMatch5.4.0

phpphpMatch5.4.0beta2

phpphpMatch5.4.0beta232-bit

phpphpMatch5.4.0rc2

phpphpMatch5.4.1

phpphpMatch5.4.2

phpphpMatch5.4.3

phpphpMatch5.4.4

phpphpMatch5.4.5

phpphpMatch5.4.6

phpphpMatch5.4.7

phpphpMatch5.4.8

phpphpMatch5.4.9

phpphpMatch5.4.10

phpphpMatch5.4.11

phpphpMatch5.4.12

phpphpMatch5.4.12rc1

phpphpMatch5.4.12rc2

phpphpMatch5.4.13

phpphpMatch5.4.13rc1

phpphpMatch5.4.14

phpphpMatch5.4.14rc1

phpphpMatch5.4.15

phpphpMatch5.4.15rc1

phpphpMatch5.4.16rc1

phpphpMatch5.4.17

phpphpMatch5.4.18

phpphpMatch5.4.19

phpphpMatch5.4.20

phpphpMatch5.4.21

phpphpMatch5.4.22

phpphpMatch5.4.23

phpphpMatch5.4.24

phpphpMatch5.4.25

phpphpMatch5.4.26

phpphpMatch5.4.27

phpphpMatch5.4.28

phpphpMatch5.4.29

phpphpMatch5.4.30

phpphpMatch5.5.0

phpphpMatch5.5.0alpha1

phpphpMatch5.5.0alpha2

phpphpMatch5.5.0alpha3

phpphpMatch5.5.0alpha4

phpphpMatch5.5.0alpha5

phpphpMatch5.5.0alpha6

phpphpMatch5.5.0beta1

phpphpMatch5.5.0beta2

phpphpMatch5.5.0beta3

phpphpMatch5.5.0beta4

phpphpMatch5.5.0rc1

phpphpMatch5.5.0rc2

phpphpMatch5.5.1

phpphpMatch5.5.2

phpphpMatch5.5.3

phpphpMatch5.5.4

phpphpMatch5.5.5

phpphpMatch5.5.6

phpphpMatch5.5.7

phpphpMatch5.5.8

phpphpMatch5.5.9

phpphpMatch5.5.10

phpphpMatch5.5.11

phpphpMatch5.5.12

phpphpMatch5.5.13

phpphpMatch5.5.14

phpphpMatch5.5.15

References

lists.apple.com/archives/security-announce/2015/Apr/msg00001.html

php.net/ChangeLog-5.php

rhn.redhat.com/errata/RHSA-2014-1326.html

rhn.redhat.com/errata/RHSA-2014-1327.html

rhn.redhat.com/errata/RHSA-2014-1765.html

rhn.redhat.com/errata/RHSA-2014-1766.html

rhn.redhat.com/errata/RHSA-2016-0760.html

secunia.com/advisories/60609

secunia.com/advisories/60696

www.debian.org/security/2014/dsa-3008

www.debian.org/security/2014/dsa-3021

www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html

www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

www.securityfocus.com/bid/69325

www.ubuntu.com/usn/USN-2344-1

www.ubuntu.com/usn/USN-2369-1

bugs.php.net/bug.php?id=67716

github.com/file/file/commit/0641e56be1af003aa02c7c6b0184466540637233

github.com/php/php-src/commit/7ba1409a1aee5925180de546057ddd84ff267947

security-tracker.debian.org/tracker/CVE-2014-3587

support.apple.com/HT204659

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

AI Score

7.2

Confidence

High

EPSS

0.08

Percentile

94.3%

JSON

CVE-2014-3587

Affected configurations

References

Related