CVE-2014-3479: Medium severity file project file vulnerability
The cdfcheckstreamoffset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3479?
CVE-2014-3479 has a severity rating that indicates it can lead to denial of service conditions.
How do I fix CVE-2014-3479?
To fix CVE-2014-3479, you should update affected versions of PHP and Fileinfo to the latest available patches.
Which versions of PHP are affected by CVE-2014-3479?
CVE-2014-3479 affects PHP versions before 5.4.30 and between 5.5.0 and 5.5.14.
What systems are impacted by CVE-2014-3479?
CVE-2014-3479 impacts systems running vulnerable versions of PHP and Fileinfo included in distributions like Debian and openSUSE.
Can CVE-2014-3479 be exploited remotely?
Yes, CVE-2014-3479 can be exploited remotely through crafted stream offsets in a CDF.