Bug 1178715 (CVE-2014-9426) - CVE-2014-9426 php: denial of service in libmagic/apprentice.c
Summary: CVE-2014-9426 php: denial of service in libmagic/apprentice.c
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2014-9426
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1178716
Blocks: 1177738
TreeView+ depends on / blocked
 
Reported: 2015-01-05 11:38 UTC by Vasyl Kaigorodov
Modified: 2019-09-29 13:25 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-01-07 05:50:27 UTC
Embargoed:

Attachments (Terms of Use)

Description Vasyl Kaigorodov 2015-01-05 11:38:53 UTC 
It was reported [1] that apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on
a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors.

Upstream commit with the fix:
http://git.php.net/?p=php-src.git;a=commit;h=a72cd07f2983dc43a6bb35209dc4687852e53c09

[1]: https://bugs.php.net/bug.php?id=68665
Comment 1 Vasyl Kaigorodov 2015-01-05 11:39:22 UTC 
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1178716]
Comment 2 Remi Collet 2015-01-06 16:06:02 UTC 
Per comment on https://bugs.php.net/bug.php?id=68665

PHP is not affected as erealloc never return NULL.
A request to revoke this CVE have be sent to oss-security.com
Comment 3 Huzaifa S. Sidhpurwala 2015-01-07 05:50:27 UTC 
As per comment #2, Red Hat Product Security Team does not consider this issue as a security flaw. Closing this bug as NOTABUG
Note You need to log in before you can comment on or make changes to this bug.