CVE-2014-9653

CVSS V2 High 7.5 CVSS V3 None
Description
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.
Overview
  • CVE ID
  • CVE-2014-9653
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2015-03-30T10:59:03
  • Last Modified Date
  • 2018-06-16T01:29:00
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:file_project:file:*:*:*:*:*:*:*:* 1 OR 5.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:* 1 OR 5.4.36
cpe:2.3:a:php:php:5.5.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:alpha1:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:alpha2:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:alpha3:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:alpha4:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:alpha5:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:alpha6:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:beta1:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:beta2:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:beta3:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:beta4:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.0:rc2:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.9:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.15:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.16:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.17:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.18:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.19:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.5.20:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.0:alpha1:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.0:alpha2:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.0:alpha3:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.0:alpha4:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.0:alpha5:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.0:beta1:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.0:beta2:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.0:beta3:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.0:beta4:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:php:php:5.6.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:P/I:P/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 7.5
  • Severity
  • HIGH
  • Exploitability Score
  • 10
  • Impact Score
  • 6.4
References
Reference URL Reference Tags
http://mx.gw.com/pipermail/file/2014/001649.html
https://github.com/file/file/commit/445c8fb0ebff85195be94cd9f7e1df89cade5c7f
http://bugs.gw.com/view.php?id=409
http://openwall.com/lists/oss-security/2015/02/05/13
http://php.net/ChangeLog-5.php
http://www.debian.org/security/2015/dsa-3196
http://marc.info/?l=bugtraq&m=143748090628601&w=2
http://marc.info/?l=bugtraq&m=144050155601375&w=2
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
http://www.securityfocus.com/bid/72516
https://security.gentoo.org/glsa/201701-42
http://rhn.redhat.com/errata/RHSA-2016-0760.html
https://usn.ubuntu.com/3686-1/
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2014-9653
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9653
History
Created Old Value New Value Data Type Notes
2022-05-10 18:42:30 Added to TrackCVE
2022-12-02 04:04:53 2015-03-30T10:59Z 2015-03-30T10:59:03 CVE Published Date updated
2022-12-02 04:04:53 2018-06-16T01:29:00 CVE Modified Date updated
2022-12-02 04:04:53 Modified Vulnerability Status updated