CVE-2014-2270

MEDIUM severity · CVSS 4.3 · Memory corruption

4.3CVSS MEDIUM

Summary

softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.

Impact & exploitability

Attack vectorNetwork

Attack complexity—

Privileges required—

User interaction—

Confidentiality impactNone

Integrity impactNone

Availability impact—

Exploit probability (EPSS)31%

AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products we track (3)

PHP Ubuntu Debian

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Official patch: http://bugs.gw.com/view.php?id=313 ↗

Additional information

NVD record
http://bugs.gw.com/view.php?id=313Patch
http://seclists.org/oss-sec/2014/q1/473Patch
http://seclists.org/oss-sec/2014/q1/504Patch
http://seclists.org/oss-sec/2014/q1/505Patch
http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.htmlAdvisory
http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.htmlAdvisory
http://lists.opensuse.org/opensuse-updates/2014-03/msg00084.htmlAdvisory
http://rhn.redhat.com/errata/RHSA-2014-1765.htmlAdvisory