CVE-2014-9653
Summary
| CVE | CVE-2014-9653 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2015-03-30 10:59:00 UTC |
|---|
| Updated | 2018-06-16 01:29:00 UTC |
|---|
| Description | readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Operating System |
Debian |
Debian Linux |
7.0 |
All |
All |
All |
| Operating System |
Debian |
Debian Linux |
7.0 |
All |
All |
All |
| Application |
File Project |
File |
All |
All |
All |
All |
| Application |
Php |
Php |
5.5.0 |
All |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha1 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha2 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha3 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha4 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha5 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha6 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
beta1 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
beta2 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
beta3 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
beta4 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
rc1 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
rc2 |
All |
All |
| Application |
Php |
Php |
5.5.1 |
All |
All |
All |
| Application |
Php |
Php |
5.5.10 |
All |
All |
All |
| Application |
Php |
Php |
5.5.11 |
All |
All |
All |
| Application |
Php |
Php |
5.5.12 |
All |
All |
All |
| Application |
Php |
Php |
5.5.13 |
All |
All |
All |
| Application |
Php |
Php |
5.5.14 |
All |
All |
All |
| Application |
Php |
Php |
5.5.15 |
All |
All |
All |
| Application |
Php |
Php |
5.5.16 |
All |
All |
All |
| Application |
Php |
Php |
5.5.17 |
All |
All |
All |
| Application |
Php |
Php |
5.5.18 |
All |
All |
All |
| Application |
Php |
Php |
5.5.19 |
All |
All |
All |
| Application |
Php |
Php |
5.5.2 |
All |
All |
All |
| Application |
Php |
Php |
5.5.20 |
All |
All |
All |
| Application |
Php |
Php |
5.5.3 |
All |
All |
All |
| Application |
Php |
Php |
5.5.4 |
All |
All |
All |
| Application |
Php |
Php |
5.5.5 |
All |
All |
All |
| Application |
Php |
Php |
5.5.6 |
All |
All |
All |
| Application |
Php |
Php |
5.5.7 |
All |
All |
All |
| Application |
Php |
Php |
5.5.8 |
All |
All |
All |
| Application |
Php |
Php |
5.5.9 |
All |
All |
All |
| Application |
Php |
Php |
5.6.0 |
alpha1 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
alpha2 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
alpha3 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
alpha4 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
alpha5 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
beta1 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
beta2 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
beta3 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
beta4 |
All |
All |
| Application |
Php |
Php |
5.6.1 |
All |
All |
All |
| Application |
Php |
Php |
5.6.2 |
All |
All |
All |
| Application |
Php |
Php |
5.6.3 |
All |
All |
All |
| Application |
Php |
Php |
5.6.4 |
All |
All |
All |
| Application |
Php |
Php |
5.5.0 |
All |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha1 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha2 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha3 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha4 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha5 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
alpha6 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
beta1 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
beta2 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
beta3 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
beta4 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
rc1 |
All |
All |
| Application |
Php |
Php |
5.5.0 |
rc2 |
All |
All |
| Application |
Php |
Php |
5.5.1 |
All |
All |
All |
| Application |
Php |
Php |
5.5.10 |
All |
All |
All |
| Application |
Php |
Php |
5.5.11 |
All |
All |
All |
| Application |
Php |
Php |
5.5.12 |
All |
All |
All |
| Application |
Php |
Php |
5.5.13 |
All |
All |
All |
| Application |
Php |
Php |
5.5.14 |
All |
All |
All |
| Application |
Php |
Php |
5.5.15 |
All |
All |
All |
| Application |
Php |
Php |
5.5.16 |
All |
All |
All |
| Application |
Php |
Php |
5.5.17 |
All |
All |
All |
| Application |
Php |
Php |
5.5.18 |
All |
All |
All |
| Application |
Php |
Php |
5.5.19 |
All |
All |
All |
| Application |
Php |
Php |
5.5.2 |
All |
All |
All |
| Application |
Php |
Php |
5.5.20 |
All |
All |
All |
| Application |
Php |
Php |
5.5.3 |
All |
All |
All |
| Application |
Php |
Php |
5.5.4 |
All |
All |
All |
| Application |
Php |
Php |
5.5.5 |
All |
All |
All |
| Application |
Php |
Php |
5.5.6 |
All |
All |
All |
| Application |
Php |
Php |
5.5.7 |
All |
All |
All |
| Application |
Php |
Php |
5.5.8 |
All |
All |
All |
| Application |
Php |
Php |
5.5.9 |
All |
All |
All |
| Application |
Php |
Php |
5.6.0 |
alpha1 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
alpha2 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
alpha3 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
alpha4 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
alpha5 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
beta1 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
beta2 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
beta3 |
All |
All |
| Application |
Php |
Php |
5.6.0 |
beta4 |
All |
All |
| Application |
Php |
Php |
5.6.1 |
All |
All |
All |
| Application |
Php |
Php |
5.6.2 |
All |
All |
All |
| Application |
Php |
Php |
5.6.3 |
All |
All |
All |
| Application |
Php |
Php |
5.6.4 |
All |
All |
All |
| Application |
Php |
Php |
All |
All |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| Bail out on partial reads, from Alexander Cherepanov · file/file@445c8fb · GitHub |
CONFIRM |
github.com |
|
| Red Hat Customer Portal |
REDHAT |
rhn.redhat.com |
|
| '[security bulletin] HPSBMU03409 rev.1 - HP Matrix Operating Environment, Multiple Vulnerabilities' - MARC |
HP |
marc.info |
|
| Debian -- Security Information -- DSA-3196-1 file |
DEBIAN |
www.debian.org |
|
| 0000409: Malformed elf file causes access to uninitialized memory - bugs.gw.com |
CONFIRM |
bugs.gw.com |
|
| file: Multiple vulnerabilities (GLSA 201701-42) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| USN-3686-1: file vulnerabilities | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
|
| Oracle Linux Bulletin - April 2016 |
CONFIRM |
www.oracle.com |
|
| Oracle Solaris Third Party Bulletin - July 2015 |
CONFIRM |
www.oracle.com |
|
| Oracle Linux Bulletin - October 2015 |
CONFIRM |
www.oracle.com |
|
| oss-security - Re: CVE Request: PHP/file: out-of-bounds memory access in softmagic |
MLIST |
openwall.com |
|
| [PATCH] readelf.c: better checks for values returned by pread |
MLIST |
mx.gw.com |
|
| '[security bulletin] HPSBMU03380 rev.1 - HP System Management Homepage (SMH) on Linux and Windows, Mu' - MARC |
HP |
marc.info |
|
| PHP: PHP 5 ChangeLog |
CONFIRM |
php.net |
|
| file 'readelf.c' Out-of-Bounds Read Vulnerability |
BID |
www.securityfocus.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 710357 Gentoo Linux file Multiple Vulnerabilities (GLSA 201701-42)
