CVE-2014-9653

Name	CVE-2014-9653
Description	readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-204-1, DSA-3196-1
Debian Bugs	777585

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
file (PTS)	buster	1:5.35-4+deb10u2	fixed
	buster (security)	1:5.35-4+deb10u1	fixed
	bullseye	1:5.39-3	fixed
	bookworm, sid	1:5.44-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
file	source	squeeze	5.04-5+squeeze10	DLA-204-1
file	source	wheezy	5.11-2+deb7u8	DSA-3196-1
file	source	(unstable)	1:5.22+15-1		777585
php5	source	(unstable)	(not affected)

Notes

- php5 <not-affected> (readelf.c not used and even removed in 5.4.36-0+deb7u3)
http://bugs.gw.com/view.php?id=409
http://mx.gw.com/pipermail/file/2014/001649.html
https://www.openwall.com/lists/oss-security/2015/02/04/13