CVE-2014-0236

published 2016-05-16

CVE-2014-0236: file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and…

high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C N I N A H

file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	file	< file 1:5.19-1 (bookworm)	file 1:5.19-1 (bookworm)
file_project	file	>= 0 < 1:5.19-1	1:5.19-1
file_project	file	>= 0 < 1:5.19-1	1:5.19-1
file_project	file	>= 0 < 1:5.19-1	1:5.19-1
file_project	file	>= 0 < 1:5.19-1	1:5.19-1
php	php	<= 5.5.35	—
redhat	libvirt	>= 0 < 1.2.2-0ubuntu13.1.16	1.2.2-0ubuntu13.1.16

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv 7.5 HIGH