CVE-2014-3587

medium · 4.3

Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.

4.3

CVSS

20.2%

EPSS (exploit prob.)

97th

EPSS percentile

2014-08-23

Published

AV:N/AC:M/Au:N/C:N/I:N/A:P

Weaknesses

CWE-189

Affected products

Vendor	Product	Affected versions
christos_zoulas	file	<= 5.19
christos_zoulas	file	5.00
christos_zoulas	file	5.01
christos_zoulas	file	5.02
christos_zoulas	file	5.03
christos_zoulas	file	5.04
christos_zoulas	file	5.05
christos_zoulas	file	5.06
christos_zoulas	file	5.07
christos_zoulas	file	5.08
christos_zoulas	file	5.09
christos_zoulas	file	5.10
christos_zoulas	file	5.11
christos_zoulas	file	5.12
christos_zoulas	file	5.13
christos_zoulas	file	5.14
christos_zoulas	file	5.15
christos_zoulas	file	5.16
christos_zoulas	file	5.17
christos_zoulas	file	5.18
php	php	<= 5.4.31
php	php	5.4.0
php	php	5.4.0
php	php	5.4.0
php	php	5.4.0
php	php	5.4.1
php	php	5.4.2
php	php	5.4.3
php	php	5.4.4
php	php	5.4.5
php	php	5.4.6
php	php	5.4.7
php	php	5.4.8
php	php	5.4.9
php	php	5.4.10
php	php	5.4.11
php	php	5.4.12
php	php	5.4.12
php	php	5.4.12
php	php	5.4.13

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-3587