PT-2016-3483 · Php · Fileinfo+1

CVE-2014-0236 · Publicado 2016-05-16 · Atualizado 2023-02-13

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Fileinfo component in PHP versions prior to 5.6.0 file versions prior to 5.18

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash. This is achieved by using a zero root storage value in a CDF file, which is related to the cdf.c and readcdf.c files.

Recommendations For file versions prior to 5.18, consider updating to version 5.18 or later to resolve the issue. For the Fileinfo component in PHP versions prior to 5.6.0, update to PHP version 5.6.0 or later to fix the problem.

Correção

Identificadores relacionados

CVE-2014-0236

Produtos afetados

Fileinfo

Php

Referências · 8

• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=f3f22ff5c697aef854ffc1918bce708b37481b0f · Nota
• http://php.net/ChangeLog-5.php · Nota
• https://security-tracker.debian.org/tracker/CVE-2014-0236 · Aviso do Fabricante
• https://bugs.php.net/bug.php?id=67329 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0236 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0236 · Nota
• https://osv.dev/vulnerability/CVE-2014-0236 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0236 · Nota de Segurança