VDB
CVE-2014-9652
CVE-2014-9652
PUBLISHED
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.
EPSS 5.45% · 92.4th percentile
Risk Scores
EPSS Score
5.45%
92.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:14.04:LTS | php5 | *, 5.5.9+dfsg-1ubuntu3, 5.5.9+dfsg-1ubuntu4 |
| Ubuntu:14.04:LTS | file | 5.11-2ubuntu4, 1:5.14-2ubuntu2, 1:5.14-2ubuntu3 |
Timeline
- CVE Published
- Aug 21, 2017 PoC Published
- Feb 4, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- Jul 18, 2023 EPSS Score
- Sep 9, 2023 EPSS Score
- Dec 23, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2014-9652 third-party-advisory
- https://ubuntu.com/security/notices/USN-2501-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2014-9652 third-party-advisory