Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.
lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
lists.opensuse.org/opensuse-updates/2014-09/msg00046.html
mx.gw.com/pipermail/file/2014/001553.html
rhn.redhat.com/errata/RHSA-2014-1327.html
rhn.redhat.com/errata/RHSA-2014-1765.html
rhn.redhat.com/errata/RHSA-2014-1766.html
secunia.com/advisories/59794
secunia.com/advisories/59831
support.apple.com/kb/HT6443
www.debian.org/security/2014/dsa-2974
www.debian.org/security/2014/dsa-3021
www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
www.php.net/ChangeLog-5.php
www.securityfocus.com/bid/68239
bugs.php.net/bug.php?id=67410
github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08
marc.info/?l=bugtraq&m=141017844705317&w=2
support.apple.com/HT204659