Buffer overflow in file - CVE-2014-3478
Published: November 27, 2018
Vulnerability identifier: #VU16088
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-3478
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14. A remote attacker can trigger memory corruption via a crafted Pascal string in a FILE_PSTRING conversion and cause the service to crash.
Affected software
file
Amazon Linux AMI
Slackware Linux
php5 (Ubuntu package)
HP-UX Web Server Suite
Amazon Linux AMI
Slackware Linux
php5 (Ubuntu package)
HP-UX Web Server Suite
How to mitigate CVE-2014-3478
Install updates from vendor's website.
file - update to 5.19
php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.26, 5.3.10-1ubuntu3.13
HP-UX Web Server Suite - update to 4.02
php5 (Ubuntu package) - addressed in versions 5.3.2-1ubuntu4.26, 5.3.10-1ubuntu3.13
HP-UX Web Server Suite - update to 4.02