CVE-2014-3487

EPSS 14.5%

Published: 7/9/2014Modified: 4/28/2026

Also known as:DEBIAN-CVE-2014-3487

Description

The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

Affected packages (1)

Debian/filefrom 0, < 1:5.19-1

References (1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2014-3487