Medium severity · published Jul 9, 2014
CVE-2014-0207
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a…
6.5
CVSS
16.9%
EPSS
No
On KEV
Description
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)16.9% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
before 5.3.29; 5.4.0 before 5.4.30; 5.5.0 before 5.5.14 · source: NVD
DL
Debian Linux · Debian
7.0; 8.0 · source: NVD
FI
File · Christos Zoulas
before 5.19 · source: NVD
LI
Linux · Oracle
7 · source: NVD
OP
Opensuse · Opensuse
11.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0207
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0207
Broken Link
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html
Issue Tracking
http://marc.info/?l=bugtraq&m=141017844705317&w=2
Broken Link
http://mx.gw.com/pipermail/file/2014/001553.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1765.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1766.html
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability