NVD

Id
36129  
Name
CVE-2014-9426  
Description
** DISPUTED ** The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-12-30  
Modified Date
2015-03-16  
Seq
2014-9426  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
184670 36129 CVE-2014-9426 http://git.php.net/?p=php-src.git;a=commit;h=a72cd07f2983dc43a6bb35209dc4687852e53c09  View
184671 36129 CVE-2014-9426 http://git.php.net/?p=php-src.git;a=commit;h=ef89ab2f99fbd9b7b714556d4f1f50644eb54191  View
184672 36129 CVE-2014-9426 openSUSE-SU-2015:0325  View
184673 36129 CVE-2014-9426 https://bugs.php.net/bug.php?id=68665  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
18568 JVNDB-2014-007443 PHP の Fileinfo コンポーネントの libmagic/apprentice.c の apprentice_load 関数におけるサービス運用妨害 (DoS) の脆弱性 ** 未確定 ** 本件は、脆弱性として確定していません。 CVE-2014-9426 76719 CVE-2014-9426 36129 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007443.html 2014-12-28 2015-04-30 View