Detections
Analytics
CVE-2014-3478
medium
Description
Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.
References
http://www.debian.org/security/2014/dsa-3021
http://www.debian.org/security/2014/dsa-2974
http://rhn.redhat.com/errata/RHSA-2014-1766.html
http://rhn.redhat.com/errata/RHSA-2014-1765.html
http://rhn.redhat.com/errata/RHSA-2014-1327.html
http://marc.info/?l=bugtraq&m=141017844705317&w=2
http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
https://support.apple.com/HT204659
https://github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08
https://bugs.php.net/bug.php?id=67410
http://www.securityfocus.com/bid/68239
http://www.php.net/ChangeLog-5.php
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://support.apple.com/kb/HT6443
http://secunia.com/advisories/59831