PT-2014-1415 · File+6 · File+6
Francisco Alonso
·
Publicado
2014-06-01
·
Atualizado
2025-12-04
·
CVE-2014-3478
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
file versions prior to 5.19
PHP versions prior to 5.4.30
PHP versions 5.5.x prior to 5.5.14
Description
The issue is related to a buffer overflow in the
mconvert function in softmagic.c in the file component, which is used in PHP. This allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE PSTRING conversion. The vulnerability can be exploited remotely, potentially leading to disruption of protected information.Recommendations
For file versions prior to 5.19, update to version 5.19 or later.
For PHP versions prior to 5.4.30, update to version 5.4.30 or later.
For PHP versions 5.5.x prior to 5.5.14, update to version 5.5.14 or later.
As a temporary workaround, consider restricting the use of the
mconvert function in softmagic.c until a patch is available.
Avoid using crafted Pascal strings in FILE PSTRING conversions until the issue is resolved.Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Centos
Hp-Ux
Php
Red Hat
Suse
Ubuntu
File