Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2014-9426 Details

Description

The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: CISA-ADPCVSS-B:7.3 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=a72cd07f2983dc43a6bb35209dc4687852e53c09 CVE
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=ef89ab2f99fbd9b7b714556d4f1f50644eb54191 CVE
http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html CVE
https://bugs.php.net/bug.php?id=68665 CVEVendor Advisory
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=a72cd07f2983dc43a6bb35209dc4687852e53c09 [email protected]

see all 8 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-17DEPRECATED: Code[email protected]

Affected Products

ProductVersions
php php
<= 5.6.4

CPE

  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

17 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2014-9426
NVD Published Date:
Dec 31, 2014
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2014-9426 Details - Not Deferred