CVE-2014-0238

Public on 2014-06-01

Modified on 2014-09-19

Description

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

Severity

Medium

See what this means

CVSS v3 Base Score

4.3

See breakdown

Affected Packages

Platform	Package	Release Date	Advisory
Amazon Linux 1	file	2014-07-23 13:57	ALAS-2014-382
Amazon Linux 1	php	2014-08-21 11:15	ALAS-2014-393
Amazon Linux 1	php54	2014-06-15 16:29	ALAS-2014-361
Amazon Linux 1	php55	2014-06-15 16:29	ALAS-2014-362

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv2	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P
NVD	CVSSv2	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

References

Red Hat: CVE-2014-0238 Mitre: CVE-2014-0238 FAQs regarding Amazon Linux ALAS/CVE Severity