PT-2014-1424 · File+7 · File+7

Francisco Alonso

·

CVE-2014-3487

·

Publicado

2014-06-01

·

Atualizado

2023-05-26

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:N/I:N/A:P
Name of the Vulnerable Software and Affected Versions File versions prior to 5.19 PHP versions prior to 5.4.30 PHP versions 5.5.x prior to 5.5.14
Description The issue is related to the cdf read property info function, which does not properly validate a stream offset. This allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. The vulnerability can be exploited remotely, potentially leading to a disruption in the availability of protected information.
Recommendations For File versions prior to 5.19, update to version 5.19 or later. For PHP versions prior to 5.4.30, update to version 5.4.30 or later. For PHP versions 5.5.x prior to 5.5.14, update to version 5.5.14 or later. As a temporary workaround, consider restricting the use of the cdf read property info function until a patch is available.

Exploit

Correção

DoS

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-189CWE-20

Identificadores relacionados

ALT-PU-2021-2505
ALT-PU-2023-1892
BDU:2015-00379
BDU:2015-01282
CESA-2014_1013
CESA-2015_2155
CVE-2014-3487
DLA-27-1
DSA-2974-1
DSA-3021-1
HPSBUX03102
MGASA-2014-0282
MGASA-2014-0283
MGASA-2014-0284
RHSA-2014:1013
RHSA-2014:1765
RHSA-2014:1766
RHSA-2014_1013
RHSA-2015:2155
RHSA-2015_2155
SUSE-SU-2015:0370-1
SUSE-SU-2015:0436-1
SUSE-SU-2015:1018-1
SUSE-SU-2015:1265-1
SUSE-SU-2016:1638-1
USN-2276-1
USN-2278-1

Produtos afetados

Alt Linux
Centos
File
Hp-Ux
Php
Red Hat
Suse
Ubuntu