Home > Vulnerability Database > CVE-2014-3478

Mend.io Vulnerability Database

CVE-2014-3478

Date: July 9, 2014

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

Language: C

Severity Score

5.3

Related Resources (24)

Url: http://secunia.com/advisories/59831

Url: http://secunia.com/advisories/59794

Url: http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html

Url: https://github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08

Url: http://www.securityfocus.com/bid/68239

Url: http://rhn.redhat.com/errata/RHSA-2014-1327.html

Url: http://support.apple.com/kb/HT6443

Url: https://bugs.php.net/bug.php?id=67410

Url: https://nvd.nist.gov/vuln/detail/CVE-2014-3478

Url: https://support.apple.com/HT204659

Url: http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Url: https://security-tracker.debian.org/tracker/CVE-2014-3478

Url: http://rhn.redhat.com/errata/RHSA-2014-1766.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2014-3478

Url: http://www.debian.org/security/2014/dsa-3021

Url: http://www.php.net/ChangeLog-5.php

Url: https://access.redhat.com/security/cve/CVE-2014-3478

Url: http://mx.gw.com/pipermail/file/2014/001553.html

Url: http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html

Url: http://rhn.redhat.com/errata/RHSA-2014-1765.html

Url: http://marc.info/?l=bugtraq&m=141017844705317&w=2

Url: http://www.debian.org/security/2014/dsa-2974

Url: http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html

Url: https://www.mend.io/vulnerability-database/CVE-2014-3478

Severity Score

5.3

Weakness Type (CWE)

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-119

CVSS v3.1

Base Score:	5.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	LOW

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2014-3478

Date: July 9, 2014

Language: C

Severity Score

Related Resources (24)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?