Description

The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

Remediation

References

CVE-2014-3480

Related Vulnerabilities

Django Resource Management Errors Vulnerability (CVE-2014-0474)

Grafana CVE-2021-27358 Vulnerability (CVE-2021-27358)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-17093)

WordPress Plugin 10Web Map Builder for Google Maps Cross-Site Scripting (1.0.69)

WordPress Plugin Everest GPlaces Business Reviews includes Backdoor [Only if downloaded via the vendor website] (1.0.9)

Severity

Medium

Classification

CVE-2014-3480 CWE-20

Tags

Missing Update Known Vulnerabilities