CoreCVE
Back

MEDIUM

file: incomplete fix for CVE-2012-1571 in cdf_read_property_info

Published Aug 23, 2014

Description

Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.

Affected products

Remediation

Red Hat statement

This issue did not affect the php and the file packages as shipped with Red Hat Enterprise Linux 5. This issue affects the versions of file as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Metrics

Weaknesses (2)

CWE-189

CWE-190

Integer Overflow

References (27)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Aug 23, 2014
Updated Aug 6, 2024
Reserved May 14, 2014
Link CVE-2014-3587
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2014-3587
Red Hat
Severity Moderate
Public date Aug 21, 2014
Links CVE-2014-3587 - Bugzilla