NetSight
IP …
medium5.0

CVE-2014-3538

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU cons…

Impact

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.

Affected products

VendorProductAffected versions
Christos ZoulasFile
through 5.18
Versions 5.00, 5.01, 5.02, 5.03, 5.04
PhpPhp
from 5.4.0 before 5.4.32
from 5.5.0 before 5.5.16
DebianDebian Linux
Versions 7.0, 8.0

Weakness classification

CWE-399

References