CVE-2014-3487: Input Validation
The cdfreadpropertyinfo function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3487?
CVE-2014-3487 has a medium severity level as it can lead to denial of service through application crashes.
How do I fix CVE-2014-3487?
To fix CVE-2014-3487, you should upgrade to the latest version of PHP that is beyond the vulnerable versions, such as 5.4.30 or 5.5.14 and higher.
Which versions of PHP are affected by CVE-2014-3487?
CVE-2014-3487 affects PHP versions prior to 5.4.30 and the 5.5.x branch prior to 5.5.14.
Are there specific operating systems impacted by CVE-2014-3487?
Yes, Debian GNU/Linux 7.0, 8.0, openSUSE 11.4, and Oracle Linux 7 are among the affected operating systems.
What type of vulnerability is CVE-2014-3487?
CVE-2014-3487 is a vulnerability related to improper validation of stream offsets that can lead to application crashes.