Description

The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

Remediation

References

CVE-2014-3480

Related Vulnerabilities

WordPress Plugin Manual Image Crop Cross-Site Scripting (1.10)

WordPress Plugin WP-Filebase Download Manager 'base' Parameter SQL Injection (0.2.9)

Piwigo Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2018-7724)

Piwigo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-5692)

WordPress Plugin Greenshift-animation and page builder blocks Cross-Site Scripting (4.9.9)

Severity

Medium

Classification

CVE-2014-3480 CWE-20

Tags

Missing Update Known Vulnerabilities