{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-03-11T00:00:00", "descriptions": [{"lang": "en", "value": "softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-30T16:57:01", "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian"}, "references": [{"name": "USN-2163-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2163-1"}, {"name": "[oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://seclists.org/oss-sec/2014/q1/504"}, {"name": "USN-2162-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2162-1"}, {"name": "[oss-security] 20140303 CVE Request: file: crashes when checking softmagic for some corrupt PE executables", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://seclists.org/oss-sec/2014/q1/473"}, {"name": "openSUSE-SU-2014:0367", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.gw.com/view.php?id=313"}, {"name": "[oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://seclists.org/oss-sec/2014/q1/505"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.php.net/ChangeLog-5.php"}, {"name": "openSUSE-SU-2014:0364", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://support.apple.com/kb/HT6443"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/file/file/commit/447558595a3650db2886cd2f416ad0beba965801"}, {"name": "RHSA-2014:1765", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2014-1765.html"}, {"name": "GLSA-201503-08", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201503-08"}, {"name": "openSUSE-SU-2014:0435", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00084.html"}, {"name": "DSA-2873", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2014/dsa-2873"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@debian.org", "ID": "CVE-2014-2270", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "USN-2163-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2163-1"}, {"name": "[oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables", "refsource": "MLIST", "url": "http://seclists.org/oss-sec/2014/q1/504"}, {"name": "USN-2162-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2162-1"}, {"name": "[oss-security] 20140303 CVE Request: file: crashes when checking softmagic for some corrupt PE executables", "refsource": "MLIST", "url": "http://seclists.org/oss-sec/2014/q1/473"}, {"name": "openSUSE-SU-2014:0367", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html"}, {"name": "http://bugs.gw.com/view.php?id=313", "refsource": "CONFIRM", "url": "http://bugs.gw.com/view.php?id=313"}, {"name": "[oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables", "refsource": "MLIST", "url": "http://seclists.org/oss-sec/2014/q1/505"}, {"name": "http://www.php.net/ChangeLog-5.php", "refsource": "CONFIRM", "url": "http://www.php.net/ChangeLog-5.php"}, {"name": "openSUSE-SU-2014:0364", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html"}, {"name": "http://support.apple.com/kb/HT6443", "refsource": "CONFIRM", "url": "http://support.apple.com/kb/HT6443"}, {"name": "https://github.com/file/file/commit/447558595a3650db2886cd2f416ad0beba965801", "refsource": "CONFIRM", "url": "https://github.com/file/file/commit/447558595a3650db2886cd2f416ad0beba965801"}, {"name": "RHSA-2014:1765", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2014-1765.html"}, {"name": "GLSA-201503-08", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201503-08"}, {"name": "openSUSE-SU-2014:0435", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00084.html"}, {"name": "DSA-2873", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2014/dsa-2873"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T10:06:00.288Z"}, "title": "CVE Program Container", "references": [{"name": "USN-2163-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2163-1"}, {"name": "[oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://seclists.org/oss-sec/2014/q1/504"}, {"name": "USN-2162-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2162-1"}, {"name": "[oss-security] 20140303 CVE Request: file: crashes when checking softmagic for some corrupt PE executables", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://seclists.org/oss-sec/2014/q1/473"}, {"name": "openSUSE-SU-2014:0367", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.gw.com/view.php?id=313"}, {"name": "[oss-security] 20140305 Re: CVE Request: file: crashes when checking softmagic for some corrupt PE executables", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://seclists.org/oss-sec/2014/q1/505"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.php.net/ChangeLog-5.php"}, {"name": "openSUSE-SU-2014:0364", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://support.apple.com/kb/HT6443"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/file/file/commit/447558595a3650db2886cd2f416ad0beba965801"}, {"name": "RHSA-2014:1765", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2014-1765.html"}, {"name": "GLSA-201503-08", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201503-08"}, {"name": "openSUSE-SU-2014:0435", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00084.html"}, {"name": "DSA-2873", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2014/dsa-2873"}]}]}, "cveMetadata": {"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "cveId": "CVE-2014-2270", "datePublished": "2014-03-14T15:00:00", "dateReserved": "2014-03-04T00:00:00", "dateUpdated": "2024-08-06T10:06:00.288Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:file_project:file:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A3FD268-A258-49C8-B334-41714D6E9A09", "versionEndExcluding": "5.17", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "D56E9C09-9D0F-4DE6-B5F7-C38CA2F69009", "versionEndExcluding": "5.4.26", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "B8ED3B2D-7952-49A4-A253-3B566A648E1D", "versionEndExcluding": "5.5.10", "versionStartIncluding": "5.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "036E8A89-7A16-411F-9D31-676313BB7244", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*", "matchCriteriaId": "01EDA41C-6B2E-49AF-B503-EB3882265C11", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*", "matchCriteriaId": "CB66DB75-2B16-4EBF-9B93-CE49D8086E41", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*", "matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*", "matchCriteriaId": "7F61F047-129C-41A6-8A27-FFCBB8563E91", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*", "matchCriteriaId": "DE554781-1EB9-446E-911F-6C11970C47F4", "vulnerable": true}, {"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*", "matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668", "vulnerable": true}, {"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*", "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable."}, {"lang": "es", "value": "softmagic.c en archivo anterior a 5.17 y libmagic permite a atacantes dependientes de contexto causar una denegaci\u00f3n de servicio (acceso a memoria fuera de rango y ca\u00edda) a trav\u00e9s de desplazamientos (\u201coffsets\u201d) manipulados en el softmagic de un ejecutable PE."}], "id": "CVE-2014-2270", "lastModified": "2022-10-28T23:23:45.870", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-03-14T15:55:05.667", "references": [{"source": "security@debian.org", "tags": ["Broken Link", "Patch"], "url": "http://bugs.gw.com/view.php?id=313"}, {"source": "security@debian.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html"}, {"source": "security@debian.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html"}, {"source": "security@debian.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://lists.opensuse.org/opensuse-updates/2014-03/msg00084.html"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2014-1765.html"}, {"source": "security@debian.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://seclists.org/oss-sec/2014/q1/473"}, {"source": "security@debian.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://seclists.org/oss-sec/2014/q1/504"}, {"source": "security@debian.org", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://seclists.org/oss-sec/2014/q1/505"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "http://support.apple.com/kb/HT6443"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "http://www.debian.org/security/2014/dsa-2873"}, {"source": "security@debian.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "http://www.php.net/ChangeLog-5.php"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "http://www.ubuntu.com/usn/USN-2162-1"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "http://www.ubuntu.com/usn/USN-2163-1"}, {"source": "security@debian.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/file/file/commit/447558595a3650db2886cd2f416ad0beba965801"}, {"source": "security@debian.org", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/201503-08"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2014:1012", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "php53-0:5.3.3-23.el5_10", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2014-08-06T00:00:00Z"}, {"advisory": "RHSA-2014:1012", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "php-0:5.3.3-27.el6_5.1", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2014-08-06T00:00:00Z"}, {"advisory": "RHSA-2014:1606", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "file-0:5.04-21.el6", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2014-10-13T00:00:00Z"}, {"advisory": "RHSA-2014:1765", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "php54-php-0:5.4.16-22.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6", "release_date": "2014-10-30T00:00:00Z"}, {"advisory": "RHSA-2014:1765", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "php54-php-0:5.4.16-22.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS", "release_date": "2014-10-30T00:00:00Z"}, {"advisory": "RHSA-2014:1765", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "php54-php-0:5.4.16-22.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.5 EUS", "release_date": "2014-10-30T00:00:00Z"}, {"advisory": "RHSA-2014:1765", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el6", "package": "php54-php-0:5.4.16-22.el6", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.6 EUS", "release_date": "2014-10-30T00:00:00Z"}, {"advisory": "RHSA-2014:1765", "cpe": "cpe:/a:redhat:rhel_software_collections:1::el7", "package": "php54-php-0:5.4.16-22.el7", "product_name": "Red Hat Software Collections 1 for Red Hat Enterprise Linux 7", "release_date": "2014-10-30T00:00:00Z"}], "bugzilla": {"description": "file: out-of-bounds access in search rules with offsets from input file", "id": "1072220", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1072220"}, "csaw": false, "cvss": {"cvss_base_score": "4.3", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "status": "verified"}, "cwe": "CWE-190->CWE-125", "details": ["softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.", "A denial of service flaw was found in the way the File Information (fileinfo) extension handled search rules. A remote attacker could use this flaw to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU."], "name": "CVE-2014-2270", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "package_name": "cdrtools", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Affected", "package_name": "file", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "php", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "package_name": "rpm", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "file", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "php", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:1", "fix_state": "Affected", "package_name": "php55-php", "product_name": "Red Hat Software Collections"}], "public_date": "2013-12-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-2270\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-2270"], "statement": "This issue did not affect the php packages as shipped with Red Hat Enterprise Linux 5. This issue did not affect the php packages as shipped with Red Hat Enterprise Linux 7.", "threat_severity": "Moderate", "upstream_fix": "php 5.5.10, file 5.17"}