CVE-2014-3710: Input Validation
An out-of-bounds read flaw was found in file's donote() function in the way the file utility determined the note headers of a elf file. This could possibly lead to file executable crash.
Upstream fix:
https://github.com/file/file/commit/39c7ac1106be844a5296d3eb5971946cc09ffda0
Other sources
The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3710?
CVE-2014-3710 has been classified as a medium severity vulnerability due to its potential to cause application crashes.
How do I fix CVE-2014-3710?
To fix CVE-2014-3710, upgrade the affected software to versions 5.4.36, 5.5.20, or 5.6.4 or later for PHP and 5.22 or later for the file utility.
Which software is affected by CVE-2014-3710?
CVE-2014-3710 affects various versions of PHP up to 5.4.35, 5.5.19, 5.6.3, and the file utility up to version 5.22.
What is the risk associated with CVE-2014-3710?
The risk associated with CVE-2014-3710 is mainly the potential for software crashes, which could lead to denial of service.
Can CVE-2014-3710 be exploited remotely?
CVE-2014-3710 does not have a direct mechanism for remote exploitation but can be triggered through crafted ELF files if the software processes them.