CVE-2014-9426

High

Published: 31/12/2014(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

The apprentice_load function in the Fileinfo component in PHP through version 5.6.4 attempts to perform a free operation on a stack-based character array, which may lead to application crashes or memory corruption.

Risk Assessment

Remote attackers may cause a denial of service, impacting application availability. There is also a possibility of unspecified other impacts.

Recommendation

It is recommended to upgrade PHP to version 5.6.4 or later to mitigate the risks associated with this vulnerability.

Other vulnerabilities in Fileinfo component in PHP

CVE-2014-0236High
PHP versions before 5.6.0 contain a vulnerability in the Fileinfo component that allows remote attackers to cause application crashes via a NULL pointer dereference. This issue occurs in CDF files with a zero root_storage value.

Original NVD description (English source)

The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable