CVE-2014-9652 The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string...
MediumCVSS 5.0
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/file(Debian:12) | < 1:5.21+15-1 | 1:5.21+15-1 |
| debian/file(Debian:13) | < 1:5.21+15-1 | 1:5.21+15-1 |
| debian/file(Debian:14) | < 1:5.21+15-1 | 1:5.21+15-1 |
| PHP | <= 5.4.36 | No fix listed |
| PHP | = 5.5.0 | No fix listed |
| PHP | = 5.5.0-alpha1 | No fix listed |
| PHP | = 5.5.0-alpha2 | No fix listed |
| PHP | = 5.5.0-alpha3 | No fix listed |
| PHP | = 5.5.0-alpha4 | No fix listed |
| PHP | = 5.5.0-alpha5 | No fix listed |
| PHP | = 5.5.0-alpha6 | No fix listed |
| PHP | = 5.5.0-beta1 | No fix listed |
| PHP | = 5.5.0-beta2 | No fix listed |
| PHP | = 5.5.0-beta3 | No fix listed |
| PHP | = 5.5.0-beta4 | No fix listed |
| PHP | = 5.5.0-rc1 | No fix listed |
| PHP | = 5.5.0-rc2 | No fix listed |
| PHP | = 5.5.1 | No fix listed |
| PHP | = 5.5.2 | No fix listed |
| PHP | = 5.5.3 | No fix listed |
| PHP | = 5.5.4 | No fix listed |
| PHP | = 5.5.5 | No fix listed |
| PHP | = 5.5.6 | No fix listed |
| PHP | = 5.5.7 | No fix listed |
| PHP | = 5.5.8 | No fix listed |
Show 26 more
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | = 5.5.9 | No fix listed |
| PHP | = 5.5.10 | No fix listed |
| PHP | = 5.5.11 | No fix listed |
| PHP | = 5.5.12 | No fix listed |
| PHP | = 5.5.13 | No fix listed |
| PHP | = 5.5.14 | No fix listed |
| PHP | = 5.5.15 | No fix listed |
| PHP | = 5.5.16 | No fix listed |
| PHP | = 5.5.17 | No fix listed |
| PHP | = 5.5.18 | No fix listed |
| PHP | = 5.5.19 | No fix listed |
| PHP | = 5.5.20 | No fix listed |
| PHP | = 5.6.0-alpha1 | No fix listed |
| PHP | = 5.6.0-alpha2 | No fix listed |
| PHP | = 5.6.0-alpha3 | No fix listed |
| PHP | = 5.6.0-alpha4 | No fix listed |
| PHP | = 5.6.0-alpha5 | No fix listed |
| PHP | = 5.6.0-beta1 | No fix listed |
| PHP | = 5.6.0-beta2 | No fix listed |
| PHP | = 5.6.0-beta3 | No fix listed |
| PHP | = 5.6.0-beta4 | No fix listed |
| PHP | = 5.6.1 | No fix listed |
| PHP | = 5.6.2 | No fix listed |
| PHP | = 5.6.3 | No fix listed |
| PHP | = 5.6.4 | No fix listed |
| file project file | <= 5.20 | No fix listed |
References
- Debian Security Tracker CVE-2014-9652 vendor-advisory
- bugs.gw.com
- APPLE-SA-2015-09-30-3 vendor-advisory
- SUSE-SU-2015:0424 vendor-advisory
- SUSE-SU-2015:0436 vendor-advisory
- openSUSE-SU-2015:0440 vendor-advisory
- HPSBMU03380 vendor-advisory
- HPSBMU03409 vendor-advisory
- [oss-security] 20150205 Re: CVE Request: PHP/file: out-of-bounds memory access in softmagic mailing-list
- php.net
- RHSA-2015:1053 vendor-advisory
- RHSA-2015:1066 vendor-advisory
- RHSA-2015:1135 vendor-advisory
- www.oracle.com
- www.oracle.com
- www.oracle.com
- 72505 vdb-entry
- bugs.php.net
- bugs.php.net
- github.com
- GLSA-201701-42 vendor-advisory
- support.apple.com