Servers and applications
CVE-2014-3587 Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.
Severity Medium 4.3
Published 23 Aug 2014
Last changed 17 Jun 2026
Added to UpHeron 14 Oct 2026
Sources NVD Affected software Software Affected versions PHPServers and applications · cpe:a:php:php Version 5.5.15 Version 5.5.14 Version 5.5.13 Version 5.5.12 All 67 release lines Every version up to 5.4.31 Version 5.4.0-beta2 Version 5.4.0-rc2 Version 5.4.0 Version 5.4.1 Version 5.4.2 Version 5.4.3 Version 5.4.4 Version 5.4.5 Version 5.4.6 Version 5.4.7 Version 5.4.8 Version 5.4.9 Version 5.4.10 Version 5.4.11 Version 5.4.12-rc1 Version 5.4.12-rc2 Version 5.4.12 Version 5.4.13-rc1 Version 5.4.13 Version 5.4.14-rc1 Version 5.4.14 Version 5.4.15-rc1 Version 5.4.15 Version 5.4.16-rc1 Version 5.4.17 Version 5.4.18 Version 5.4.19 Version 5.4.20 Version 5.4.21 Version 5.4.22 Version 5.4.23 Version 5.4.24 Version 5.4.25 Version 5.4.26 Version 5.4.27 Version 5.4.28 Version 5.4.29 Version 5.4.30 Version 5.5.0-alpha1 Version 5.5.0-alpha2 Version 5.5.0-alpha3 Version 5.5.0-alpha4 Version 5.5.0-alpha5 Version 5.5.0-alpha6 Version 5.5.0-beta1 Version 5.5.0-beta2 Version 5.5.0-beta3 Version 5.5.0-beta4 Version 5.5.0-rc1 Version 5.5.0-rc2 Version 5.5.0 Version 5.5.1 Version 5.5.2 Version 5.5.3 Version 5.5.4 Version 5.5.5 Version 5.5.6 Version 5.5.7 Version 5.5.8 Version 5.5.9 Version 5.5.10 Version 5.5.11 Version 5.5.12 Version 5.5.13 Version 5.5.14 Version 5.5.15
References NVD https://nvd.nist.gov/vuln/detail/CVE-2014-3587 CVE.org https://www.cve.org/CVERecord?id=CVE-2014-3587