CVE-2014-3478

medium · 6.5

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

6.5

CVSS

15.2%

EPSS (exploit prob.)

97th

EPSS percentile

2014-07-09

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses

CWE-119

Affected products

Vendor	Product	Affected versions
christos_zoulas	file	<= 5.18
christos_zoulas	file	5.00
christos_zoulas	file	5.01
christos_zoulas	file	5.02
christos_zoulas	file	5.03
christos_zoulas	file	5.04
christos_zoulas	file	5.05
christos_zoulas	file	5.06
christos_zoulas	file	5.07
christos_zoulas	file	5.08
christos_zoulas	file	5.09
christos_zoulas	file	5.10
christos_zoulas	file	5.11
christos_zoulas	file	5.12
christos_zoulas	file	5.13
christos_zoulas	file	5.14
christos_zoulas	file	5.15
christos_zoulas	file	5.16
christos_zoulas	file	5.17
php	php	<= 5.4.29
php	php	5.4.0
php	php	5.4.1
php	php	5.4.2
php	php	5.4.3
php	php	5.4.4
php	php	5.4.5
php	php	5.4.6
php	php	5.4.7
php	php	5.4.8
php	php	5.4.9
php	php	5.4.10
php	php	5.4.11
php	php	5.4.12
php	php	5.4.12
php	php	5.4.12
php	php	5.4.13
php	php	5.4.13
php	php	5.4.14
php	php	5.4.14
php	php	5.4.15

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-3478