PT-2014-1415 · File+6 · File+6

Francisco Alonso · Published 2014-06-01 · Updated 2025-12-04 · CVE-2014-3478

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions file versions prior to 5.19 PHP versions prior to 5.4.30 PHP versions 5.5.x prior to 5.5.14

Description The issue is related to a buffer overflow in the mconvert function in softmagic.c in the file component, which is used in PHP. This allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE PSTRING conversion. The vulnerability can be exploited remotely, potentially leading to disruption of protected information.

Recommendations For file versions prior to 5.19, update to version 5.19 or later. For PHP versions prior to 5.4.30, update to version 5.4.30 or later. For PHP versions 5.5.x prior to 5.5.14, update to version 5.5.14 or later. As a temporary workaround, consider restricting the use of the mconvert function in softmagic.c until a patch is available. Avoid using crafted Pascal strings in FILE PSTRING conversions until the issue is resolved.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-189

CWE-119

Related Identifiers

BDU:2015-00370

BDU:2015-01282

CESA-2014_1327

CESA-2015_2155

CVE-2014-3478

DLA-27-1

DSA-2974-1

DSA-3021-1

HPSBUX03102

MGASA-2014-0282

MGASA-2014-0283

MGASA-2014-0284

RHSA-2014:1327

RHSA-2014:1765

RHSA-2014:1766

RHSA-2014_1327

RHSA-2015:2155

RHSA-2015_2155

SUSE-SU-2015:0370-1

SUSE-SU-2015:0436-1

SUSE-SU-2015:1018-1

SUSE-SU-2015:1265-1

SUSE-SU-2016:1638-1

USN-2276-1

USN-2278-1

Affected Products

Centos

Hp-Ux

Php

Red Hat

Suse

Ubuntu

File

References · 228

• 🔥 https://github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08 · Exploit
• https://bugs.php.net/bug.php?id=67410 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3480 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-3478 · Security Note
• https://advisories.mageia.org/MGASA-2014-0283.html · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0282 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3478 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3478 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0284.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0238 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3478 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3538 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3479 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-1765.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2276-1 · Vendor Advisory