blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2013-7345

MEDIUM 5.0 CVSS 2.0
Published
March 24, 2014
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
CVSS vector
AV:N/AC:L/Au:N/C:N/I:N/A:P

Description

The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.

Affected products and versions

  • PHP — From 5.4.0 (including) to 5.4.27 (excluding)
  • PHP — From 5.5.0 (including) to 5.5.11 (excluding)

References

  • bugs.gw.com http://bugs.gw.com/view.php?id=164 Broken Link, Exploit, Issue Tracking, Patch, Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2014-1765.html Third Party Advisory
  • support.apple.com http://support.apple.com/kb/HT6443 Third Party Advisory
  • www.debian.org http://www.debian.org/security/2014/dsa-2873 Third Party Advisory
  • bugs.debian.org https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703993 Issue Tracking, Third Party Advisory
  • github.com https://github.com/file/file/commit/ef2329cf71acb59204dd981e2c6cce6c81fe467c Exploit, Patch, Third Party Advisory
  • nvd.nist.gov Official NVD record