Описание
The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.
Отчет
This issue did not affect the php and the file packages as shipped with Red Hat Enterprise Linux 5. This issue affects the versions of file as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | cdrtools | Not affected | ||
| Red Hat Enterprise Linux 5 | file | Not affected | ||
| Red Hat Enterprise Linux 5 | php | Not affected | ||
| Red Hat Enterprise Linux 5 | rpm | Not affected | ||
| Red Hat Enterprise Linux 5 | php53 | Fixed | RHSA-2014:1012 | 06.08.2014 |
| Red Hat Enterprise Linux 6 | php | Fixed | RHSA-2014:1012 | 06.08.2014 |
| Red Hat Enterprise Linux 6 | file | Fixed | RHSA-2014:1606 | 13.10.2014 |
| Red Hat Enterprise Linux 7 | php | Fixed | RHSA-2014:1013 | 06.08.2014 |
| Red Hat Enterprise Linux 7 | file | Fixed | RHSA-2015:2155 | 19.11.2015 |
| Red Hat Software Collections 1 for Red Hat Enterprise Linux 6 | php54-php | Fixed | RHSA-2014:1765 | 30.10.2014 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS2
Связанные уязвимости
The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
The cdf_read_property_info function in cdf.c in the Fileinfo component ...
The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.
Уязвимость интерпретатора PHP, позволяющая удаленному злоумышленнику вызвать отказ в обслуживании
EPSS
4.3 Medium
CVSS2