NVD

Id
36272  
Name
CVE-2014-9652  
Description
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2015-03-30  
Modified Date
2016-12-30  
Seq
2014-9652  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
185326 36272 CVE-2014-9652 http://bugs.gw.com/view.php?id=398  View
185327 36272 CVE-2014-9652 APPLE-SA-2015-09-30-3  View
185328 36272 CVE-2014-9652 SUSE-SU-2015:0424  View
185329 36272 CVE-2014-9652 SUSE-SU-2015:0436  View
185330 36272 CVE-2014-9652 openSUSE-SU-2015:0440  View
185331 36272 CVE-2014-9652 HPSBMU03380  View
185332 36272 CVE-2014-9652 HPSBMU03409  View
185333 36272 CVE-2014-9652 [oss-security] 20150205 Re: CVE Request: PHP/file: out-of-bounds memory access in softmagic  View
185334 36272 CVE-2014-9652 http://php.net/ChangeLog-5.php  View
185335 36272 CVE-2014-9652 RHSA-2015:1053  View
185336 36272 CVE-2014-9652 RHSA-2015:1066  View
185337 36272 CVE-2014-9652 RHSA-2015:1135  View
185338 36272 CVE-2014-9652 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html  View
185339 36272 CVE-2014-9652 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html  View
185340 36272 CVE-2014-9652 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html  View
185341 36272 CVE-2014-9652 72505  View
185342 36272 CVE-2014-9652 https://bugs.php.net/bug.php?id=68735  View
185343 36272 CVE-2014-9652 https://bugs.php.net/patch-display.php?bug=68735&patch=bug68735.patch&revision=1420309079  View
185344 36272 CVE-2014-9652 https://github.com/file/file/commit/59e63838913eee47f5c120a6c53d4565af638158  View
185345 36272 CVE-2014-9652 https://support.apple.com/HT205267  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19128 JVNDB-2014-008003 PHP の Fileinfo コンポーネントで使用される file の softmagic.c におけるサービス運用妨害 (DoS) の脆弱性 PHP の Fileinfo コンポーネントで使用される file の softmagic.c 内の mconvert 関数は、切り捨て処理 (truncated) された Pascal 文字列をコピーする際に、特定の string-length フィールドを適切に処理しないため、サービス運用妨害 (メモリ領域外へのアクセスおよびアプリケーションクラッシュ) 状態にされる脆弱性が存在します。 CVE-2014-9652 76945 CVE-2014-9652 36272 5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-008003.html 2014-11-10 2015-10-06 View