PHP Fileinfo component vulnerabilities
4 known CVE vulnerabilities in PHP Fileinfo component, translated and rated.
- CVE-2015-8865High
The file_check_mem function in funcs.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 mishandles continuation-level jumps. This can lead to application crashes or potentially allow attackers to execute arbitrary code via a crafted magic file.
- CVE-2015-4605High
The mcopy function in softmagic.c in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not properly restrict a certain offset value, allowing remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string.
- CVE-2015-4604High
The mget function in softmagic.c in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not properly maintain a certain pointer relationship, allowing remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string.
- CVE-2014-9653High
In readelf.c in PHP versions before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, there is a vulnerability that does not consider that pread calls may read only a subset of available data. This allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.