CVE-2013-4636 Denial of service in n/a
Remote attackers can crash PHP applications by uploading a malicious MP3 file that triggers an invalid pointer dereference in the Fileinfo component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-4636?
CVE-2013-4636 is a medium-severity denial of service vulnerability in Php Php, published on 21 Jun 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object.
Weakness: CWE-20
Which versions are affected by CVE-2013-4636?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2013-4636?
No fix has been published for CVE-2013-4636 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2013-4636 being exploited?
There is no known exploitation of CVE-2013-4636 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-m6h3-3xr9-pp23.