CVE-2014-0207: Buffer Overflow
Invalid pointer dereference flaws were found in the way file, utility for determining of file types processed header section for certain Composite Document Format (CDF) files. A remote attacker could provide a specially-crafted CDF file, which once inspected by the file utility of the victim would lead to file executable crash.
Other sources
The cdfreadshortsector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0207?
CVE-2014-0207 has been classified with a moderate severity rating due to the potential for exploitation via specially-crafted CDF files.
How do I fix CVE-2014-0207?
To fix CVE-2014-0207, update the 'file' utility to the latest version beyond 5.19 or ensure PHP is upgraded to versions above 5.3.29.
Which systems are affected by CVE-2014-0207?
CVE-2014-0207 affects several systems including older versions of the 'file' utility and PHP on distributions like Debian GNU/Linux, Oracle Linux, and openSUSE.
Can CVE-2014-0207 be exploited remotely?
Yes, CVE-2014-0207 can be exploited remotely if a user inspects a maliciously crafted CDF file using the vulnerable utility.
What types of attacks could CVE-2014-0207 facilitate?
CVE-2014-0207 could facilitate denial-of-service attacks or potentially allow an attacker to execute arbitrary code on the victim's system.