{"id":"CVE-2014-3478","url":"https://www.cyber-defence.io/tools/cve/CVE-2014-3478","generatedAt":"2026-10-27T18:55:41.120Z","title":"Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal…","description":"Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.","published":"2014-07-09T11:07:02.000Z","lastModified":"2026-06-17T00:08:16.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"},"cwe":["CWE-119"],"affected":["christos zoulas/file","php/php"],"epss":{"score":0.15176,"percentile":0.96725,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 15.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html","source":"secalert@redhat.com"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html","source":"secalert@redhat.com"},{"url":"http://marc.info/?l=bugtraq&m=141017844705317&w=2","source":"secalert@redhat.com"},{"url":"http://mx.gw.com/pipermail/file/2014/001553.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1327.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1765.html","source":"secalert@redhat.com"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1766.html","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59794","source":"secalert@redhat.com"},{"url":"http://secunia.com/advisories/59831","source":"secalert@redhat.com"},{"url":"http://support.apple.com/kb/HT6443","source":"secalert@redhat.com"},{"url":"http://www.debian.org/security/2014/dsa-2974","source":"secalert@redhat.com"},{"url":"http://www.debian.org/security/2014/dsa-3021","source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","source":"secalert@redhat.com"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","source":"secalert@redhat.com"},{"url":"http://www.php.net/ChangeLog-5.php","source":"secalert@redhat.com"},{"url":"http://www.securityfocus.com/bid/68239","source":"secalert@redhat.com"},{"url":"https://bugs.php.net/bug.php?id=67410","tags":["Patch"],"source":"secalert@redhat.com"},{"url":"https://github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08","tags":["Exploit","Patch"],"source":"secalert@redhat.com"},{"url":"https://support.apple.com/HT204659","source":"secalert@redhat.com"},{"url":"http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-09/msg00046.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://marc.info/?l=bugtraq&m=141017844705317&w=2","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://mx.gw.com/pipermail/file/2014/001553.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1327.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1765.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1766.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/59794","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/59831","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://support.apple.com/kb/HT6443","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2014/dsa-2974","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2014/dsa-3021","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.php.net/ChangeLog-5.php","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/68239","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.php.net/bug.php?id=67410","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08","tags":["Exploit","Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/HT204659","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-3478","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}