blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2014-3710

MEDIUM 5.0 CVSS 2.0
Published
November 5, 2014
Last modified
June 17, 2026
NVD status
Modified
Reported by
secalert@redhat.com
Weakness
CWE-20
CVSS vector
AV:N/AC:L/Au:N/C:N/I:N/A:P

Description

The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.

Affected products and versions

  • PHP — From 5.4.0 (including) to 5.4.35 (excluding)
  • PHP — From 5.5.0 (including) to 5.5.19 (excluding)
  • PHP — From 5.6.0 (including) to 5.6.3 (excluding)

References

  • git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=1803228597e82218a8c105e67975bc50e6f5bf0d
  • linux.oracle.com http://linux.oracle.com/errata/ELSA-2014-1767.html Third Party Advisory
  • linux.oracle.com http://linux.oracle.com/errata/ELSA-2014-1768.html Third Party Advisory
  • lists.apple.com http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html Mailing List, Third Party Advisory
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2014-11/msg00113.html Mailing List, Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2014-1765.html Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2014-1766.html Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2014-1767.html Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2014-1768.html Third Party Advisory
  • rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-0760.html Third Party Advisory
  • secunia.com http://secunia.com/advisories/60630 Third Party Advisory
  • secunia.com http://secunia.com/advisories/60699 Third Party Advisory
  • secunia.com http://secunia.com/advisories/61763 Third Party Advisory
  • secunia.com http://secunia.com/advisories/61970 Third Party Advisory
  • secunia.com http://secunia.com/advisories/61982 Third Party Advisory
  • secunia.com http://secunia.com/advisories/62347 Third Party Advisory
  • secunia.com http://secunia.com/advisories/62559 Third Party Advisory
  • www.debian.org http://www.debian.org/security/2014/dsa-3072 Third Party Advisory
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html Third Party Advisory
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html Third Party Advisory
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html Third Party Advisory
  • www.oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html Third Party Advisory
  • www.securityfocus.com http://www.securityfocus.com/bid/70807 Third Party Advisory, VDB Entry
  • www.securitytracker.com http://www.securitytracker.com/id/1031344 Third Party Advisory, VDB Entry
  • www.ubuntu.com http://www.ubuntu.com/usn/USN-2391-1 Third Party Advisory
  • www.ubuntu.com http://www.ubuntu.com/usn/USN-2494-1 Third Party Advisory
  • bugs.php.net https://bugs.php.net/bug.php?id=68283 Patch, Vendor Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1155071 Issue Tracking, Third Party Advisory
  • github.com https://github.com/file/file/commit/39c7ac1106be844a5296d3eb5971946cc09ffda0 Patch, Third Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/201503-03 Third Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/201701-42 Third Party Advisory
  • support.apple.com https://support.apple.com/HT204659 Third Party Advisory
  • www.freebsd.org https://www.freebsd.org/security/advisories/FreeBSD-SA-14:28.file.asc Third Party Advisory
  • nvd.nist.gov Official NVD record