What’s Vulnerable › Vulnerabilities

CVE-2014-3538

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 11.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-07-03 · updated 2026-06-17
• Weakness: CWE-399

Description

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.

Affected products

• Christos Zoulas File: through 5.18; 5.00, 5.01, 5.02, 5.03, 5.04, 5.05 (+12)
• Debian Linux: 7.0, 8.0
• PHP: from 5.4.0 before 5.4.32; from 5.5.0 before 5.5.16 — fixed in 5.4.32, 5.5.16

How to fix

Upgrade to a fixed version: PHP 5.4.32, 5.5.16. Check the vendor advisory for mitigations.

References

• http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
• http://mx.gw.com/pipermail/file/2014/001553.html
• http://openwall.com/lists/oss-security/2014/06/30/7
• http://rhn.redhat.com/errata/RHSA-2014-1327.html
• http://rhn.redhat.com/errata/RHSA-2014-1765.html
• http://rhn.redhat.com/errata/RHSA-2014-1766.html
• http://rhn.redhat.com/errata/RHSA-2016-0760.html
• http://secunia.com/advisories/60696
• http://www.debian.org/security/2014/dsa-3008
• http://www.debian.org/security/2014/dsa-3021
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html

Get alerted when CVE-2014-3538 or the next vulnerability affects your stack