p PatchFirst

CVE-2014-3478

CVE-2014-3478

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

CVSS 6.5 · Medium · EPSS 15.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • file Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:5.19-1

    Update to 1:5.19-1

  • file Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:5.19-1

    Update to 1:5.19-1

  • file Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:5.19-1

    Update to 1:5.19-1

  • file Ubuntu:14.04:LTS

    Versions
    • 5.11-2ubuntu4
    • 1:5.14-2ubuntu1
    • 1:5.14-2ubuntu2
    • 1:5.14-2ubuntu3
    Affected ranges
    • ECOSYSTEM: < 1:5.14-2ubuntu3.1

    Update to 1:5.14-2ubuntu3.1

  • php5 Ubuntu:14.04:LTS

    Versions
    • 5.5.3+dfsg-1ubuntu2
    • 5.5.3+dfsg-1ubuntu3
    • 5.5.6+dfsg-1ubuntu1
    • 5.5.6+dfsg-1ubuntu2
    • 5.5.8+dfsg-2ubuntu1
    • 5.5.9+dfsg-1ubuntu1
    • 5.5.9+dfsg-1ubuntu2
    • 5.5.9+dfsg-1ubuntu3
    • 5.5.9+dfsg-1ubuntu4
    • 5.5.9+dfsg-1ubuntu4.1
    • 5.5.9+dfsg-1ubuntu4.2
    Affected ranges
    • ECOSYSTEM: < 5.5.9+dfsg-1ubuntu4.3

    Update to 5.5.9+dfsg-1ubuntu4.3

Original sources

Check your server →