CVE-2013-7345
php5 - security update
EPSS 3.0%
描述
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
如何修補 CVE-2013-7345
要修補 CVE-2013-7345,請將受影響套件升級到下列已修補版本。
- Debian/file—升級至 1:5.17-0.1 或更新版本
- Debian/file—升級至 5.04-5+squeeze4 或更新版本
- —升級至 5.4.34-0+deb7u1 或更新版本
CVE-2013-7345 正在被利用嗎?
低 — EPSS 為 3.0%,目前沒有觀察到大規模利用活動。
受影響套件(3)
- from 0, < 1:5.17-0.1
- from 0, < 5.04-5+squeeze4
- from 0, < 5.4.34-0+deb7u1