NVD

Id
36273  
Name
CVE-2014-9653  
Description
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-03-30  
Modified Date
2016-11-28  
Seq
2014-9653  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
185346 36273 CVE-2014-9653 http://bugs.gw.com/view.php?id=409  View
185347 36273 CVE-2014-9653 HPSBMU03380  View
185348 36273 CVE-2014-9653 HPSBMU03409  View
185349 36273 CVE-2014-9653 [file] 20141216 [PATCH] readelf.c: better checks for values returned by pread  View
185350 36273 CVE-2014-9653 [oss-security] 20150205 Re: CVE Request: PHP/file: out-of-bounds memory access in softmagic  View
185351 36273 CVE-2014-9653 http://php.net/ChangeLog-5.php  View
185352 36273 CVE-2014-9653 DSA-3196  View
185353 36273 CVE-2014-9653 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html  View
185354 36273 CVE-2014-9653 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html  View
185355 36273 CVE-2014-9653 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html  View
185356 36273 CVE-2014-9653 72516  View
185357 36273 CVE-2014-9653 https://github.com/file/file/commit/445c8fb0ebff85195be94cd9f7e1df89cade5c7f  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19127 JVNDB-2014-008002 PHP の Fileinfo コンポーネントで使用される file の readelf.c におけるサービス運用妨害 (DoS) の脆弱性 PHP の Fileinfo コンポーネントで使用される file の readelf.c は、pread が利用可能なデータの一部しか読まないことがあることを考慮しないため、サービス運用妨害 (未初期化メモリへのアクセス) 状態にされるなど、不特定の影響を受ける脆弱性が存在します。 CVE-2014-9653 76946 CVE-2014-9653 36273 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-008002.html 2014-12-17 2015-07-30 View