CVE-2014-3487

The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

• CWE-20

• http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlBroken Link, Mailing List
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.htmlMailing List, Third Party Advisory
• http://marc.info/?l=bugtraq&m=141017844705317&w=2Issue Tracking, Third Party Advisory
• http://mx.gw.com/pipermail/file/2014/001553.htmlBroken Link
• http://rhn.redhat.com/errata/RHSA-2014-1765.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1766.htmlThird Party Advisory
• http://secunia.com/advisories/59794Not Applicable
• http://secunia.com/advisories/59831Not Applicable
• http://support.apple.com/kb/HT6443Third Party Advisory
• http://www.debian.org/security/2014/dsa-2974Third Party Advisory
• http://www.debian.org/security/2014/dsa-3021Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlThird Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
• http://www.php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
• http://www.securityfocus.com/bid/68120Third Party Advisory, VDB Entry
• https://bugs.php.net/bug.php?id=67413Issue Tracking, Patch, Vendor Advisory
• https://github.com/file/file/commit/93e063ee374b6a75729df9e7201fb511e47e259dPatch, Third Party Advisory
• https://support.apple.com/HT204659Third Party Advisory
• http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlBroken Link, Mailing List
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.htmlMailing List, Third Party Advisory
• http://marc.info/?l=bugtraq&m=141017844705317&w=2Issue Tracking, Third Party Advisory
• http://mx.gw.com/pipermail/file/2014/001553.htmlBroken Link
• http://rhn.redhat.com/errata/RHSA-2014-1765.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1766.htmlThird Party Advisory
• http://secunia.com/advisories/59794Not Applicable
• http://secunia.com/advisories/59831Not Applicable
• http://support.apple.com/kb/HT6443Third Party Advisory
• http://www.debian.org/security/2014/dsa-2974Third Party Advisory
• http://www.debian.org/security/2014/dsa-3021Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlThird Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
• http://www.php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
• http://www.securityfocus.com/bid/68120Third Party Advisory, VDB Entry
• https://bugs.php.net/bug.php?id=67413Issue Tracking, Patch, Vendor Advisory
• https://github.com/file/file/commit/93e063ee374b6a75729df9e7201fb511e47e259dPatch, Third Party Advisory
• https://support.apple.com/HT204659Third Party Advisory

Published

Jul 9, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3481org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in R…
• CVE-2014-3482SQL injection vulnerability in activerecord/lib/active_recor…
• CVE-2014-3483SQL injection vulnerability in activerecord/lib/active_recor…
• CVE-2014-3484Multiple stack-based buffer overflows in the __dn_expand fun…9.8
• CVE-2014-3485The REST API in the ovirt-engine in oVirt, as used in Red Ha…
• CVE-2014-3486The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and …
• CVE-2014-3488The SslHandler in Netty before 3.9.2 allows remote attackers…
• CVE-2014-3489lib/util/miq-password.rb in Red Hat CloudForms 3.0 Managemen…
• CVE-2014-3490RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as use…
• CVE-2014-3491Cross-site scripting (XSS) vulnerability in Foreman before 1…
• CVE-2014-3492Multiple cross-site scripting (XSS) vulnerabilities in the h…
• CVE-2014-3493The push_ascii function in smbd in Samba 3.6.x before 3.6.24…