Medium severity · published Jul 9, 2014
CVE-2014-3478
Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote…
6.5
CVSS
15.2%
EPSS
No
On KEV
Description
Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)15.2% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
PHP · PHP
through 5.4.29; 5.4.0; 5.4.1; 5.4.2; 5.4.3; 5.4.4; +34 more · source: NVD
FI
File · Christos Zoulas
through 5.18; 5.00; 5.01; 5.02; 5.03; 5.04; +13 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3478
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3478
lists.apple.com
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html
marc.info
http://marc.info/?l=bugtraq&m=141017844705317&w=2
mx.gw.com
http://mx.gw.com/pipermail/file/2014/001553.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1327.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1765.html
More from PHP
9.8
CVE-2026-109618
RCE via OOM corruption
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute…
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability