Description

The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

Remediation

References

CVE-2014-3480

Related Vulnerabilities

ProjectSend Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-40888)

WordPress Plugin Download Manager Directory Traversal (3.2.54)

WordPress Plugin Quiz and Survey Master (QSM)-Easy Quiz and Survey Maker SQL Injection (7.1.11)

Oracle JRE CVE-2013-1486 Vulnerability (CVE-2013-1486)

Joomla! Core Security Bypass (2.5.0 - 3.9.27)

Severity

Medium

Classification

CVE-2014-3480 CWE-20

Tags

Missing Update Known Vulnerabilities