Home > Vulnerability Database > CVE-2014-9652

Mend.io Vulnerability Database

CVE-2014-9652

Date: March 30, 2015

The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.

Language: C

Severity Score

5.3

Related Resources (26)

Url: http://rhn.redhat.com/errata/RHSA-2015-1053.html

Url: https://bugs.php.net/bug.php?id=68735

Url: https://support.apple.com/HT205267

Url: https://bugs.php.net/patch-display.php?bug=68735&patch=bug68735.patch&revision=1420309079

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2014-9652

Url: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00003.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2014-9652

Url: http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Url: https://github.com/file/file/commit/59e63838913eee47f5c120a6c53d4565af638158

Url: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00004.html

Url: http://openwall.com/lists/oss-security/2015/02/05/12

Url: http://www.securityfocus.com/bid/72505

Url: http://php.net/ChangeLog-5.php

Url: https://access.redhat.com/security/cve/CVE-2014-9652

Url: https://security-tracker.debian.org/tracker/CVE-2014-9652

Url: http://rhn.redhat.com/errata/RHSA-2015-1135.html

Url: http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00002.html

Url: http://rhn.redhat.com/errata/RHSA-2015-1066.html

Url: http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html

Url: https://security.gentoo.org/glsa/201701-42

Url: http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

Url: http://marc.info/?l=bugtraq&m=144050155601375&w=2

Url: http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Url: http://bugs.gw.com/view.php?id=398

Url: http://marc.info/?l=bugtraq&m=143748090628601&w=2

Url: https://www.mend.io/vulnerability-database/CVE-2014-9652

Severity Score

5.3

Weakness Type (CWE)

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-119

CVSS v3.1

Base Score:	5.3
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	LOW

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2014-9652

Date: March 30, 2015

Language: C

Severity Score

Related Resources (26)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?