CVE-2014-3478

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 15.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-07-09 · updated 2026-06-17
Weakness: CWE-119

Description

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

Affected products

Christos Zoulas File: through 5.18; 5.00, 5.01, 5.02, 5.03, 5.04, 5.05 (+12)
PHP: through 5.4.29; 5.4.0, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5 (+53)

References

http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html
http://marc.info/?l=bugtraq&m=141017844705317&w=2
http://mx.gw.com/pipermail/file/2014/001553.html
http://rhn.redhat.com/errata/RHSA-2014-1327.html
http://rhn.redhat.com/errata/RHSA-2014-1765.html
http://rhn.redhat.com/errata/RHSA-2014-1766.html
http://secunia.com/advisories/59794
http://secunia.com/advisories/59831
http://support.apple.com/kb/HT6443
http://www.debian.org/security/2014/dsa-2974
http://www.debian.org/security/2014/dsa-3021

Get alerted when CVE-2014-3478 or the next vulnerability affects your stack