CVE-2014-3538
NoneCVSS
—
EPSS
11.8%
Published
Jul 3, 2014
CISA due date
—
The record
file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | file | 0 | 1:5.19-1 |
| Debian:12 | file | 0 | 1:5.19-1 |
| Debian:13 | file | 0 | 1:5.19-1 |
| Debian:6.0 | file | 0 | 5.04-5+squeeze7 |
| Debian:6.0 | php5 | 0 | 5.3.3-7+squeeze22 |
| Debian:7 | file | 0 | 5.11-2+deb7u4 |
| Debian:7 | php5 | 0 | 5.4.4-14+deb7u13 |
| Mageia:3 | file | 0 | 5.12-8.6.mga3 |
| Mageia:3 | php | 0 | 5.4.31-1.2.mga3 |
| Mageia:3 | php-apc | 0 | 3.1.14-7.11.mga3 |
| Mageia:3 | php-gd-bundled | 0 | 5.4.31-1.mga3 |
| Mageia:3 | php-timezonedb | 0 | 2014.5-1.mga3 |
| Mageia:4 | file | 0 | 5.16-1.5.mga4 |
| Mageia:4 | php | 0 | 5.5.15-1.1.mga4 |
| Mageia:4 | php-apc | 0 | 3.1.15-4.6.mga4 |
| Mageia:4 | php-timezonedb | 0 | 2014.5-1.mga4 |
| Red Hat:enterprise_linux:6::client | file | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::client | file-debuginfo | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::client | file-devel | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::client | file-libs | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::client | file-static | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::client | python-magic | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::computenode | file | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::computenode | file-debuginfo | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::computenode | file-devel | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::computenode | file-libs | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::computenode | file-static | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::computenode | python-magic | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::server | file | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::server | file-debuginfo | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::server | file-devel | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::server | file-libs | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::server | file-static | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::server | python-magic | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::workstation | file | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::workstation | file-debuginfo | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::workstation | file-devel | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::workstation | file-libs | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::workstation | file-static | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:6::workstation | python-magic | 0 | 0:5.04-30.el6 |
| Red Hat:enterprise_linux:7::client | file | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::client | file-debuginfo | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::client | file-devel | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::client | file-libs | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::client | file-static | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::client | php | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-bcmath | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-cli | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-common | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-dba | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-debuginfo | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-devel | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-embedded | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-enchant | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-fpm | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-gd | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-intl | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-ldap | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-mbstring | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-mysql | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-mysqlnd | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-odbc | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-pdo | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-pgsql | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-process | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-pspell | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-recode | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-snmp | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-soap | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-xml | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | php-xmlrpc | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::client | python-magic | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::computenode | file | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::computenode | file-debuginfo | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::computenode | file-devel | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::computenode | file-libs | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::computenode | file-static | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::computenode | php | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-bcmath | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-cli | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-common | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-dba | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-debuginfo | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-devel | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-embedded | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-enchant | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-fpm | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-gd | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-intl | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-ldap | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-mbstring | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-mysql | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-mysqlnd | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-odbc | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-pdo | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-pgsql | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-process | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-pspell | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-recode | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-snmp | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-soap | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-xml | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | php-xmlrpc | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::computenode | python-magic | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::server | file | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::server | file-debuginfo | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::server | file-devel | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::server | file-libs | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::server | file-static | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::server | php | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-bcmath | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-cli | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-common | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-dba | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-debuginfo | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-devel | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-embedded | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-enchant | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-fpm | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-gd | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-intl | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-ldap | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-mbstring | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-mysql | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-mysqlnd | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-odbc | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-pdo | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-pgsql | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-process | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-pspell | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-recode | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-snmp | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-soap | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-xml | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | php-xmlrpc | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::server | python-magic | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::workstation | file | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::workstation | file-debuginfo | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::workstation | file-devel | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::workstation | file-libs | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::workstation | file-static | 0 | 0:5.11-31.el7 |
| Red Hat:enterprise_linux:7::workstation | php | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-bcmath | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-cli | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-common | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-dba | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-debuginfo | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-devel | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-embedded | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-enchant | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-fpm | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-gd | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-intl | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-ldap | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-mbstring | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-mysql | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-mysqlnd | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-odbc | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-pdo | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-pgsql | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-process | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-pspell | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-recode | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-snmp | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-soap | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-xml | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | php-xmlrpc | 0 | 0:5.4.16-23.el7_0.1 |
| Red Hat:enterprise_linux:7::workstation | python-magic | 0 | 0:5.11-31.el7 |
| Red Hat:rhel_software_collections:1::el6 | php54-php | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-bcmath | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-cli | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-common | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-dba | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-debuginfo | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-devel | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-enchant | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-fpm | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-gd | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-imap | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-intl | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-ldap | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-mbstring | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-mysqlnd | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-odbc | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-pdo | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-pgsql | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-process | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-pspell | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-recode | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-snmp | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-soap | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-tidy | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-xml | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php54-php-xmlrpc | 0 | 0:5.4.16-22.el6 |
| Red Hat:rhel_software_collections:1::el6 | php55-php | 0 | 0:5.5.6-13.el6 |
| Red Hat:rhel_software_collections:1::el6 | php55-php-bcmath | 0 | 0:5.5.6-13.el6 |
| Red Hat:rhel_software_collections:1::el6 | php55-php-cli | 0 | 0:5.5.6-13.el6 |
| Red Hat:rhel_software_collections:1::el6 | php55-php-common | 0 | 0:5.5.6-13.el6 |
| Red Hat:rhel_software_collections:1::el6 | php55-php-dba | 0 | 0:5.5.6-13.el6 |
| Red Hat:rhel_software_collections:1::el6 | php55-php-debuginfo | 0 | 0:5.5.6-13.el6 |
Related vulnerabilities
- CVE-2015-8865 The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo… Also affects file
- CVE-2014-9620 The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of… Also affects file
- CVE-2014-8117 softmagic.c in file before 5.21 does not properly limit recursion, which allows remote… Also affects file
- CVE-2014-3710 The donote function in readelf.c in file through 5.20, as used in the Fileinfo component… Also affects file
- CVE-2014-3587 Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as… Also affects file
- CVE-2014-3480 The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo… Also affects file
- CVE-2014-3478 Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in… Also affects file
- CVE-2014-3487 The cdf_read_property_info function in file before 5.19, as used in the Fileinfo… Also affects file