CVE-2013-4636

2022-10-0316:14:56

Debian Security Bug Tracker

security-tracker.debian.org

php 5.4.x

denial of service

mp3 file

mime type detection

fileinfo

remote attackers

invalid pointer dereference

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

60.3%

JSON

The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object.

OSVersionArchitecturePackageVersionFilename
Debian12allfile< 1:5.44-3file_1:5.44-3_all.deb
Debian11allfile< 1:5.39-3+deb11u1file_1:5.39-3+deb11u1_all.deb
Debian999allfile< 1:5.45-3file_1:5.45-3_all.deb
Debian13allfile< 1:5.45-3file_1:5.45-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	file	< 1:5.44-3	file_1:5.44-3_all.deb
Debian	11	all	file	< 1:5.39-3+deb11u1	file_1:5.39-3+deb11u1_all.deb
Debian	999	all	file	< 1:5.45-3	file_1:5.45-3_all.deb
Debian	13	all	file	< 1:5.45-3	file_1:5.45-3_all.deb