CVE-2014-3487

Public on 2014-07-09

Modified on 2014-09-19

Description

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

Severity

Medium

See what this means

CVSS v3 Base Score

4.3

See breakdown

Affected Packages

Platform	Package	Release Date	Advisory
Amazon Linux 1	file	2014-07-23 13:57	ALAS-2014-382
Amazon Linux 1	php54	2014-07-09 16:24	ALAS-2014-367
Amazon Linux 1	php55	2014-07-09 16:42	ALAS-2014-372

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv2	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P
NVD	CVSSv2	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P

References

Red Hat: CVE-2014-3487 Mitre: CVE-2014-3487 FAQs regarding Amazon Linux ALAS/CVE Severity