cve/2014/CVE-2014-3480.md

CVE-2014-3480

Description

The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

POC

Reference

• http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Github

• https://github.com/Live-Hack-CVE/CVE-2014-3480