CVE-2014-3478

Name of the Vulnerable Software and Affected Versions file versions prior to 5.19 PHP versions prior to 5.4.30 PHP versions 5.5.x prior to 5.5.14

Description The issue is related to a buffer overflow in the mconvert function in softmagic.c in the file component, which is used in PHP. This allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE PSTRING conversion. The vulnerability can be exploited remotely, potentially leading to disruption of protected information.

Recommendations For file versions prior to 5.19, update to version 5.19 or later. For PHP versions prior to 5.4.30, update to version 5.4.30 or later. For PHP versions 5.5.x prior to 5.5.14, update to version 5.5.14 or later. As a temporary workaround, consider restricting the use of the mconvert function in softmagic.c until a patch is available. Avoid using crafted Pascal strings in FILE PSTRING conversions until the issue is resolved.