Skip to content
Fencer Intel
medium 6.5

CVE-2014-3478 json

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5…

published 12y ago modified 4mo ago also EUVD-2014-3487

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
15.2%
EPSS 15.2% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

Patch / fix

  • file Debian 14, Debian 13, Debian 12 1:5.19-1

debian advisories DEBIAN-CVE-2014-3478

  • file Ubuntu 14.04 LTS 1:5.14-2ubuntu3.1
  • php5 Ubuntu 14.04 LTS 5.5.9+dfsg-1ubuntu4.3

ubuntu advisories UBUNTU-CVE-2014-3478

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • file RHEL 7 5.11-31.el7
  • file-libs RHEL 7 5.11-31.el7
  • python-magic RHEL 7 5.11-31.el7
  • php RHEL 7 5.4.16-23.el7_0.1
  • php-gd RHEL 7 5.4.16-23.el7_0.1
  • php-cli RHEL 7 5.4.16-23.el7_0.1
  • php-dba RHEL 7 5.4.16-23.el7_0.1
  • php-fpm RHEL 7 5.4.16-23.el7_0.1

red hat advisories RHSA-2015:2155RHSA-2014:1327RHSA-2014:1766RHSA-2014:1765

  • php53 SLES 11 SP2-LTSS 5.3.17-47.1

suse advisories SUSE-SU-2016:1638-1

Is CVE-2014-3478 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-3478 updated cvss 4.3

file: mconvert incorrect handling of truncated pascal string size

  • Red Hat Enterprise Linux 5 rpm
    affected: no fix available
  • Red Hat Enterprise Linux Client (v. 7) file 5.11-31.el7, file-libs 5.11-31.el7, python-magic 5.11-31.el7
    fixed: vendor fix RHSA-2015:2155
  • Red Hat Enterprise Linux Client Optional (v. 7) php 5.4.16-23.el7_0.1, php-gd 5.4.16-23.el7_0.1, php-cli 5.4.16-23.el7_0.1, php-dba 5.4.16-23.el7_0.1, php-fpm 5.4.16-23.el7_0.1, php-pdo 5.4.16-23.el7_0.1, +18 more
    fixed: vendor fix RHSA-2014:1327
  • Red Hat Enterprise Linux ComputeNode (v. 7) file 5.11-31.el7, file-libs 5.11-31.el7, python-magic 5.11-31.el7
    fixed: vendor fix RHSA-2015:2155
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) php 5.4.16-23.el7_0.1, php-gd 5.4.16-23.el7_0.1, php-cli 5.4.16-23.el7_0.1, php-dba 5.4.16-23.el7_0.1, php-fpm 5.4.16-23.el7_0.1, php-pdo 5.4.16-23.el7_0.1, +18 more Red Hat Enterprise Linux Server (v. 7) file 5.11-31.el7, file-libs 5.11-31.el7, php 5.4.16-23.el7_0.1, php-gd 5.4.16-23.el7_0.1, python-magic 5.11-31.el7, php-cli 5.4.16-23.el7_0.1, +11 more Red Hat Enterprise Linux Server Optional (v. 7) php-dba 5.4.16-23.el7_0.1, php-fpm 5.4.16-23.el7_0.1, php-intl 5.4.16-23.el7_0.1, php-snmp 5.4.16-23.el7_0.1, php-bcmath 5.4.16-23.el7_0.1, php-pspell 5.4.16-23.el7_0.1, +4 more Red Hat Enterprise Linux Workstation (v. 7) file 5.11-31.el7, file-libs 5.11-31.el7, php 5.4.16-23.el7_0.1, php-gd 5.4.16-23.el7_0.1, python-magic 5.11-31.el7, php-cli 5.4.16-23.el7_0.1, +11 more Red Hat Enterprise Linux Workstation Optional (v. 7) php-dba 5.4.16-23.el7_0.1, php-fpm 5.4.16-23.el7_0.1, php-intl 5.4.16-23.el7_0.1, php-snmp 5.4.16-23.el7_0.1, php-bcmath 5.4.16-23.el7_0.1, php-pspell 5.4.16-23.el7_0.1, +4 more
    fixed: vendor fix RHSA-2014:1327
  • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) php55-php 5.5.6-13.el6, php54-php 5.4.16-22.el6, php55-php-gd 5.5.6-13.el6, php54-php-gd 5.4.16-22.el6, php55-php-cli 5.5.6-13.el6, php55-php-dba 5.5.6-13.el6, +44 more Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) php55-php 5.5.6-13.el7, php54-php 5.4.16-22.el7, php55-php-gd 5.5.6-13.el7, php54-php-gd 5.4.16-22.el7, php55-php-cli 5.5.6-13.el7, php55-php-dba 5.5.6-13.el7, +40 more Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) php55-php 5.5.6-13.el6, php54-php 5.4.16-22.el6, php55-php-gd 5.5.6-13.el6, php54-php-gd 5.4.16-22.el6, php55-php-cli 5.5.6-13.el6, php55-php-dba 5.5.6-13.el6, +44 more Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5) php55-php 5.5.6-13.el6, php54-php 5.4.16-22.el6, php55-php-gd 5.5.6-13.el6, php54-php-gd 5.4.16-22.el6, php55-php-cli 5.5.6-13.el6, php55-php-dba 5.5.6-13.el6, +44 more Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6) php55-php 5.5.6-13.el6, php54-php 5.4.16-22.el6, php55-php-gd 5.5.6-13.el6, php54-php-gd 5.4.16-22.el6, php55-php-cli 5.5.6-13.el6, php55-php-dba 5.5.6-13.el6, +44 more Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) php55-php 5.5.6-13.el6, php54-php 5.4.16-22.el6, php55-php-gd 5.5.6-13.el6, php54-php-gd 5.4.16-22.el6, php55-php-cli 5.5.6-13.el6, php55-php-dba 5.5.6-13.el6, +44 more
    +1 more products
    Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) php55-php 5.5.6-13.el7, php54-php 5.4.16-22.el7, php55-php-gd 5.5.6-13.el7, php54-php-gd 5.4.16-22.el7, php55-php-cli 5.5.6-13.el7, php55-php-dba 5.5.6-13.el7, +40 more
    fixed: vendor fix RHSA-2014:1765
  • Red Hat Enterprise Linux 5 php, file, php53, cdrtools Red Hat Enterprise Linux 6 php, file, php-gd, php-cli, php-dba, php-fpm, +23 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
11mo ago

Exploit prediction

15.18% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.