1. CVE-Search
  2. CVE-2014-3538
ID CVE-2014-3538
Summary file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.
References
Vulnerable Configurations
  • cpe:2.3:a:christos_zoulas:file:5.00:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.00:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.01:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.01:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.02:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.02:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.03:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.03:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.04:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.04:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.05:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.05:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.06:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.06:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.07:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.07:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.08:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.08:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.09:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.09:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.10:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.10:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.11:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.11:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.12:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.12:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.13:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.13:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.14:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.14:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.15:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.15:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.16:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.16:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.17:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.17:*:*:*:*:*:*:*
  • cpe:2.3:a:christos_zoulas:file:5.18:*:*:*:*:*:*:*
    cpe:2.3:a:christos_zoulas:file:5.18:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 05-01-2018 - 02:29)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
redhat via4
advisories
  • rhsa
    id RHSA-2014:1327
  • rhsa
    id RHSA-2014:1765
  • rhsa
    id RHSA-2014:1766
  • rhsa
    id RHSA-2016:0760
rpms
  • php-0:5.4.16-23.el7_0.1
  • php-bcmath-0:5.4.16-23.el7_0.1
  • php-cli-0:5.4.16-23.el7_0.1
  • php-common-0:5.4.16-23.el7_0.1
  • php-dba-0:5.4.16-23.el7_0.1
  • php-debuginfo-0:5.4.16-23.el7_0.1
  • php-devel-0:5.4.16-23.el7_0.1
  • php-embedded-0:5.4.16-23.el7_0.1
  • php-enchant-0:5.4.16-23.el7_0.1
  • php-fpm-0:5.4.16-23.el7_0.1
  • php-gd-0:5.4.16-23.el7_0.1
  • php-intl-0:5.4.16-23.el7_0.1
  • php-ldap-0:5.4.16-23.el7_0.1
  • php-mbstring-0:5.4.16-23.el7_0.1
  • php-mysql-0:5.4.16-23.el7_0.1
  • php-mysqlnd-0:5.4.16-23.el7_0.1
  • php-odbc-0:5.4.16-23.el7_0.1
  • php-pdo-0:5.4.16-23.el7_0.1
  • php-pgsql-0:5.4.16-23.el7_0.1
  • php-process-0:5.4.16-23.el7_0.1
  • php-pspell-0:5.4.16-23.el7_0.1
  • php-recode-0:5.4.16-23.el7_0.1
  • php-snmp-0:5.4.16-23.el7_0.1
  • php-soap-0:5.4.16-23.el7_0.1
  • php-xml-0:5.4.16-23.el7_0.1
  • php-xmlrpc-0:5.4.16-23.el7_0.1
  • php54-php-0:5.4.16-22.el6
  • php54-php-0:5.4.16-22.el7
  • php54-php-bcmath-0:5.4.16-22.el6
  • php54-php-bcmath-0:5.4.16-22.el7
  • php54-php-cli-0:5.4.16-22.el6
  • php54-php-cli-0:5.4.16-22.el7
  • php54-php-common-0:5.4.16-22.el6
  • php54-php-common-0:5.4.16-22.el7
  • php54-php-dba-0:5.4.16-22.el6
  • php54-php-dba-0:5.4.16-22.el7
  • php54-php-debuginfo-0:5.4.16-22.el6
  • php54-php-debuginfo-0:5.4.16-22.el7
  • php54-php-devel-0:5.4.16-22.el6
  • php54-php-devel-0:5.4.16-22.el7
  • php54-php-enchant-0:5.4.16-22.el6
  • php54-php-enchant-0:5.4.16-22.el7
  • php54-php-fpm-0:5.4.16-22.el6
  • php54-php-fpm-0:5.4.16-22.el7
  • php54-php-gd-0:5.4.16-22.el6
  • php54-php-gd-0:5.4.16-22.el7
  • php54-php-imap-0:5.4.16-22.el6
  • php54-php-intl-0:5.4.16-22.el6
  • php54-php-intl-0:5.4.16-22.el7
  • php54-php-ldap-0:5.4.16-22.el6
  • php54-php-ldap-0:5.4.16-22.el7
  • php54-php-mbstring-0:5.4.16-22.el6
  • php54-php-mbstring-0:5.4.16-22.el7
  • php54-php-mysqlnd-0:5.4.16-22.el6
  • php54-php-mysqlnd-0:5.4.16-22.el7
  • php54-php-odbc-0:5.4.16-22.el6
  • php54-php-odbc-0:5.4.16-22.el7
  • php54-php-pdo-0:5.4.16-22.el6
  • php54-php-pdo-0:5.4.16-22.el7
  • php54-php-pgsql-0:5.4.16-22.el6
  • php54-php-pgsql-0:5.4.16-22.el7
  • php54-php-process-0:5.4.16-22.el6
  • php54-php-process-0:5.4.16-22.el7
  • php54-php-pspell-0:5.4.16-22.el6
  • php54-php-pspell-0:5.4.16-22.el7
  • php54-php-recode-0:5.4.16-22.el6
  • php54-php-recode-0:5.4.16-22.el7
  • php54-php-snmp-0:5.4.16-22.el6
  • php54-php-snmp-0:5.4.16-22.el7
  • php54-php-soap-0:5.4.16-22.el6
  • php54-php-soap-0:5.4.16-22.el7
  • php54-php-tidy-0:5.4.16-22.el6
  • php54-php-xml-0:5.4.16-22.el6
  • php54-php-xml-0:5.4.16-22.el7
  • php54-php-xmlrpc-0:5.4.16-22.el6
  • php54-php-xmlrpc-0:5.4.16-22.el7
  • php55-php-0:5.5.6-13.el6
  • php55-php-0:5.5.6-13.el7
  • php55-php-bcmath-0:5.5.6-13.el6
  • php55-php-bcmath-0:5.5.6-13.el7
  • php55-php-cli-0:5.5.6-13.el6
  • php55-php-cli-0:5.5.6-13.el7
  • php55-php-common-0:5.5.6-13.el6
  • php55-php-common-0:5.5.6-13.el7
  • php55-php-dba-0:5.5.6-13.el6
  • php55-php-dba-0:5.5.6-13.el7
  • php55-php-debuginfo-0:5.5.6-13.el6
  • php55-php-debuginfo-0:5.5.6-13.el7
  • php55-php-devel-0:5.5.6-13.el6
  • php55-php-devel-0:5.5.6-13.el7
  • php55-php-enchant-0:5.5.6-13.el6
  • php55-php-enchant-0:5.5.6-13.el7
  • php55-php-fpm-0:5.5.6-13.el6
  • php55-php-fpm-0:5.5.6-13.el7
  • php55-php-gd-0:5.5.6-13.el6
  • php55-php-gd-0:5.5.6-13.el7
  • php55-php-gmp-0:5.5.6-13.el6
  • php55-php-gmp-0:5.5.6-13.el7
  • php55-php-imap-0:5.5.6-13.el6
  • php55-php-intl-0:5.5.6-13.el6
  • php55-php-intl-0:5.5.6-13.el7
  • php55-php-ldap-0:5.5.6-13.el6
  • php55-php-ldap-0:5.5.6-13.el7
  • php55-php-mbstring-0:5.5.6-13.el6
  • php55-php-mbstring-0:5.5.6-13.el7
  • php55-php-mysqlnd-0:5.5.6-13.el6
  • php55-php-mysqlnd-0:5.5.6-13.el7
  • php55-php-odbc-0:5.5.6-13.el6
  • php55-php-odbc-0:5.5.6-13.el7
  • php55-php-opcache-0:5.5.6-13.el6
  • php55-php-opcache-0:5.5.6-13.el7
  • php55-php-pdo-0:5.5.6-13.el6
  • php55-php-pdo-0:5.5.6-13.el7
  • php55-php-pgsql-0:5.5.6-13.el6
  • php55-php-pgsql-0:5.5.6-13.el7
  • php55-php-process-0:5.5.6-13.el6
  • php55-php-process-0:5.5.6-13.el7
  • php55-php-pspell-0:5.5.6-13.el6
  • php55-php-pspell-0:5.5.6-13.el7
  • php55-php-recode-0:5.5.6-13.el6
  • php55-php-recode-0:5.5.6-13.el7
  • php55-php-snmp-0:5.5.6-13.el6
  • php55-php-snmp-0:5.5.6-13.el7
  • php55-php-soap-0:5.5.6-13.el6
  • php55-php-soap-0:5.5.6-13.el7
  • php55-php-tidy-0:5.5.6-13.el6
  • php55-php-xml-0:5.5.6-13.el6
  • php55-php-xml-0:5.5.6-13.el7
  • php55-php-xmlrpc-0:5.5.6-13.el6
  • php55-php-xmlrpc-0:5.5.6-13.el7
  • file-0:5.11-31.el7
  • file-debuginfo-0:5.11-31.el7
  • file-devel-0:5.11-31.el7
  • file-libs-0:5.11-31.el7
  • file-static-0:5.11-31.el7
  • python-magic-0:5.11-31.el7
  • file-0:5.04-30.el6
  • file-debuginfo-0:5.04-30.el6
  • file-devel-0:5.04-30.el6
  • file-libs-0:5.04-30.el6
  • file-static-0:5.04-30.el6
  • python-magic-0:5.04-30.el6
refmap via4
apple APPLE-SA-2015-04-08-2
bid 68348
confirm
debian
  • DSA-3008
  • DSA-3021
mlist
  • [file] 20140612 file-5.19 is now available
  • [oss-security] 20140630 changing CVE ID for RH Bugzilla 1098222 (from CVE-2014-0235)
secunia 60696
Last major update 05-01-2018 - 02:29
Published 03-07-2014 - 14:55
Last modified 05-01-2018 - 02:29
Back to Top