CVE-2014-9652: Buffer Overflow

Q: What is the severity of CVE-2014-9652?

CVE-2014-9652 is classified as a medium severity vulnerability due to its potential for remote code execution.

Q: How do I fix CVE-2014-9652?

To fix CVE-2014-9652, upgrade PHP to version 5.4.37, 5.5.21, or 5.6.5 or later.

Q: What software versions are affected by CVE-2014-9652?

CVE-2014-9652 affects PHP versions before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5.

Q: What does CVE-2014-9652 exploit?

CVE-2014-9652 exploits improper handling of a certain string-length field during the processing of truncated Pascal strings.

Q: Can CVE-2014-9652 be exploited by remote attackers?

Yes, CVE-2014-9652 can potentially allow remote attackers to execute arbitrary code on vulnerable systems.

Published Mar 30, 2015

Updated

The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file.

Affected Software

48 affected components

PHP PHP<=5.4.36

PHP PHP=5.5.0

PHP PHP=5.5.0-alpha1

PHP PHP=5.5.0-alpha2

PHP PHP=5.5.0-alpha3

PHP PHP=5.5.0-alpha4

PHP PHP=5.5.0-alpha5

PHP PHP=5.5.0-alpha6

PHP PHP=5.5.0-beta1

PHP PHP=5.5.0-beta2

PHP PHP=5.5.0-beta3

PHP PHP=5.5.0-beta4

PHP PHP=5.5.0-rc1

PHP PHP=5.5.0-rc2

PHP PHP=5.5.1

PHP PHP=5.5.2

PHP PHP=5.5.3

PHP PHP=5.5.4

PHP PHP=5.5.5

PHP PHP=5.5.6

PHP PHP=5.5.7

PHP PHP=5.5.8

PHP PHP=5.5.9

PHP PHP=5.5.10

PHP PHP=5.5.11

PHP PHP=5.5.12

PHP PHP=5.5.13

PHP PHP=5.5.14

PHP PHP=5.5.15

PHP PHP=5.5.16

PHP PHP=5.5.17

PHP PHP=5.5.18

PHP PHP=5.5.19

PHP PHP=5.5.20

PHP PHP=5.6.0-alpha1

PHP PHP=5.6.0-alpha2

PHP PHP=5.6.0-alpha3

PHP PHP=5.6.0-alpha4

PHP PHP=5.6.0-alpha5

PHP PHP=5.6.0-beta1

PHP PHP=5.6.0-beta2

PHP PHP=5.6.0-beta3

PHP PHP=5.6.0-beta4

PHP PHP=5.6.1

PHP PHP=5.6.2

PHP PHP=5.6.3

PHP PHP=5.6.4

File Project File<=5.20

Event History

Mar 30, 2015

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9652?

CVE-2014-9652 is classified as a medium severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2014-9652?

To fix CVE-2014-9652, upgrade PHP to version 5.4.37, 5.5.21, or 5.6.5 or later.

What software versions are affected by CVE-2014-9652?