Vulnerability Description
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| File Project | File | <= 5.21 |
| Php | Php | <= 5.4.36 |
| Debian | Debian Linux | 7.0 |
Related Weaknesses (CWE)
References
- http://bugs.gw.com/view.php?id=409
- http://marc.info/?l=bugtraq&m=143748090628601&w=2
- http://marc.info/?l=bugtraq&m=144050155601375&w=2
- http://mx.gw.com/pipermail/file/2014/001649.html
- http://openwall.com/lists/oss-security/2015/02/05/13
- http://php.net/ChangeLog-5.php
- http://rhn.redhat.com/errata/RHSA-2016-0760.html
- http://www.debian.org/security/2015/dsa-3196
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.h
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.h
- http://www.securityfocus.com/bid/72516
- https://github.com/file/file/commit/445c8fb0ebff85195be94cd9f7e1df89cade5c7f
- https://security.gentoo.org/glsa/201701-42
- https://usn.ubuntu.com/3686-1/
FAQ
What is CVE-2014-9653?
CVE-2014-9653 is a vulnerability with a CVSS score of 7.5 (HIGH). readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of t...
How severe is CVE-2014-9653?
CVE-2014-9653 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-9653?
Check the references section above for vendor advisories and patch information. Affected products include: File Project File, Php Php, Debian Debian Linux.