PT-2016-3483 · Php · Fileinfo+1

Published 2016-05-16 · Updated 2023-02-13 · CVE-2014-0236

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Fileinfo component in PHP versions prior to 5.6.0 file versions prior to 5.18

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash. This is achieved by using a zero root storage value in a CDF file, which is related to the cdf.c and readcdf.c files.

Recommendations For file versions prior to 5.18, consider updating to version 5.18 or later to resolve the issue. For the Fileinfo component in PHP versions prior to 5.6.0, update to PHP version 5.6.0 or later to fix the problem.

Fix

Related Identifiers

CVE-2014-0236

Affected Products

Fileinfo

Php

References · 8

• https://security-tracker.debian.org/tracker/CVE-2014-0236 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0236 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-0236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0236 · Security Note
• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=f3f22ff5c697aef854ffc1918bce708b37481b0f · Note
• http://php.net/ChangeLog-5.php · Note
• https://bugs.php.net/bug.php?id=67329 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0236 · Note