CVE-2014-0207: christos_zoulas file
Vulnerability summary
CVE-2014-0207 is a medium (CVSS 6.5) vulnerability in christos_zoulas file. EPSS estimates a 16.93% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 3Timeline
- 09-07-2014PublishedVulnerability first disclosed.
- 04-12-2025Last modifiedVulnerability information updated.
Description
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.
CVSS metrics
5 scores · 4 sources · 2 versions- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
16.93%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
Increase +0.07 pp
From 16.85% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- file< 1:5.19-1
- debian_linuxEOL7.0 | 8.0
Ubuntu2 products
- file< 1:5.14-2ubuntu3.1
- php5< 5.5.9+dfsg-1ubuntu4.3
Christos_zoulas1 product
- file< 5.19
Opensuse1 product
- opensuseEOL11.4
Oracle1 product
- linuxEOL7
Php1 product
- php< 5.3.29 | ≥ 5.4.0, < 5.4.30 | ≥ 5.5.0, < 5.5.14
6 vendors · 8 products
References
24 links- bugzilla.redhat.com/show_bug.cgi?id=1091842X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- marc.info?l=bugtraq&m=141017844705317&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
- www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlX Refsource CONFIRMThird Party Advisory
Show all 24 references
- github.com/file/file/commit/6d209c1c489457397a5763bca4b28e43aac90391X Refsource CONFIRMPatchThird Party Advisory
- lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
- www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlX Refsource CONFIRMThird Party Advisory
- lists.opensuse.org/opensuse-updates/2014-09/msg00046.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory