FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2014-0207

This CVE name corresponds to:

Entered	Topic
2014-08-18	PHP multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2014-0207 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2014-0207
Phase	Assigned(20131203)

Description

The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

References

Source	Reference
MLIST	[file] 20140612 file-5.19 is now available
CONFIRM	http://www.php.net/ChangeLog-5.php
CONFIRM	https://bugs.php.net/bug.php?id=67326
CONFIRM	https://bugzilla.redhat.com/show_bug.cgi?id=1091842
CONFIRM	https://github.com/file/file/commit/6d209c1c489457397a5763bca4b28e43aac90391
CONFIRM	http://support.apple.com/kb/HT6443
CONFIRM	https://support.apple.com/HT204659
APPLE	APPLE-SA-2015-04-08-2
DEBIAN	DSA-2974
DEBIAN	DSA-3021
REDHAT	RHSA-2014:1765
REDHAT	RHSA-2014:1766
SUSE	openSUSE-SU-2014:1236
SECUNIA	59794
SECUNIA	59831