Executive Summary

Summary
Title php5 security update
Informations
Name DSA-2868 First vendor Publication 2014-03-02
Vendor Debian Last vendor Modification 2014-03-02
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

It was discovered that file, a file type classification tool, contains a flaw in the handling of "indirect" magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain files. The Common Vulnerabilities and Exposures project ID CVE-2014-1943 has been assigned to identify this flaw. Additionally, other well-crafted files might result in long computation times (while using 100% CPU) and overlong results.

This update corrects this flaw in the copy that is embedded in the php5 package.

For the oldstable distribution (squeeze), this problem has been fixed in version 5.3.3-7+squeeze19.

For the stable distribution (wheezy), this problem has been fixed in version 5.4.4-14+deb7u8.

For the testing distribution (jessie) and the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your php5 packages.

Original Source

Url : http://www.debian.org/security/2014/dsa-2868

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-755 Improper Handling of Exceptional Conditions

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:23670
 
Oval ID: oval:org.mitre.oval:def:23670
Title: DSA-2861-1 file - denial of service
Description: It was discovered that file, a file type classification tool, contains a flaw in the handling of <q>indirect</q> magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain files.
Family: unix Class: patch
Reference(s): DSA-2861-1
CVE-2014-1943
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
Product(s): file
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23706
 
Oval ID: oval:org.mitre.oval:def:23706
Title: DSA-2868-1 php5 - denial of service
Description: It was discovered that file, a file type classification tool, contains a flaw in the handling of <q>indirect</q> magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain files.
Family: unix Class: patch
Reference(s): DSA-2868-1
CVE-2014-1943
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
Product(s): php5
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24044
 
Oval ID: oval:org.mitre.oval:def:24044
Title: USN-2123-1 -- file vulnerabilities
Description: File could be made to crash if it processed a specially crafted file.
Family: unix Class: patch
Reference(s): USN-2123-1
CVE-2012-1571
CVE-2014-1943
Version: 5
Platform(s): Ubuntu 13.10
Ubuntu 12.10
Ubuntu 12.04
Ubuntu 10.04
Product(s): file
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 15
Application 545
Os 4
Os 2

Nessus® Vulnerability Scanner

Date Description
2016-08-12 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_70140f20600711e6a6c314dae9d210b8.nasl - Type : ACT_GATHER_INFO
2015-03-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-080.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_php_20140522.nasl - Type : ACT_GATHER_INFO
2014-11-12 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1606.nasl - Type : ACT_GATHER_INFO
2014-11-04 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20141014_file_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-10-17 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1606.nasl - Type : ACT_GATHER_INFO
2014-10-14 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1606.nasl - Type : ACT_GATHER_INFO
2014-09-18 Name : The remote host is missing a Mac OS X update that fixes multiple vulnerabilit...
File : macosx_10_9_5.nasl - Type : ACT_GATHER_INFO
2014-08-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201408-11.nasl - Type : ACT_GATHER_INFO
2014-08-07 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140806_php53_and_php_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-08-07 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1012.nasl - Type : ACT_GATHER_INFO
2014-08-07 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1012.nasl - Type : ACT_GATHER_INFO
2014-08-06 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1012.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-209.nasl - Type : ACT_GATHER_INFO
2014-03-28 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-313.nasl - Type : ACT_GATHER_INFO
2014-03-28 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-314.nasl - Type : ACT_GATHER_INFO
2014-03-18 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-304.nasl - Type : ACT_GATHER_INFO
2014-03-17 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-059.nasl - Type : ACT_GATHER_INFO
2014-03-17 Name : The remote Fedora host is missing a security update.
File : fedora_2014-3537.nasl - Type : ACT_GATHER_INFO
2014-03-17 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2014-074-01.nasl - Type : ACT_GATHER_INFO
2014-03-14 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-051.nasl - Type : ACT_GATHER_INFO
2014-03-14 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201403-03.nasl - Type : ACT_GATHER_INFO
2014-03-10 Name : The remote Fedora host is missing a security update.
File : fedora_2014-3534.nasl - Type : ACT_GATHER_INFO
2014-03-07 Name : The remote web server uses a version of PHP that is potentially affected by m...
File : php_5_5_10.nasl - Type : ACT_GATHER_INFO
2014-03-07 Name : The remote web server uses a version of PHP that is potentially affected by m...
File : php_5_4_26.nasl - Type : ACT_GATHER_INFO
2014-03-04 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2126-1.nasl - Type : ACT_GATHER_INFO
2014-03-04 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_815dbcf9a2d611e38088002590860428.nasl - Type : ACT_GATHER_INFO
2014-03-04 Name : The remote Fedora host is missing a security update.
File : fedora_2014-2876.nasl - Type : ACT_GATHER_INFO
2014-03-03 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2868.nasl - Type : ACT_GATHER_INFO
2014-02-27 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2123-1.nasl - Type : ACT_GATHER_INFO
2014-02-24 Name : The remote Fedora host is missing a security update.
File : fedora_2014-2739.nasl - Type : ACT_GATHER_INFO
2014-02-17 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2861.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-03-04 13:21:18
  • Multiple Updates
2014-03-02 21:19:19
  • First insertion