---
title: "CVE-2014-3710\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2014-3710?format=md
keywords: index, follow
---

# CVE-2014-3710

Publication date 24 October 2014

Last updated 24 July 2024

---

Ubuntu priority

**Low**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

The donote function in readelf.c in file through 5.20, as used in the
Fileinfo component in PHP 5.4.34, does not ensure that sufficient note
headers are present, which allows remote attackers to cause a denial of
service (out-of-bounds read and application crash) via a crafted ELF file.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| file | 14.10 utopic | Fixed 1:5.19-1ubuntu1.2 |
| 14.04 LTS trusty | Fixed 1:5.14-2ubuntu3.3 |
| 12.04 LTS precise | Fixed 5.09-2ubuntu0.6 |
| 10.04 LTS lucid | Fixed 5.03-5ubuntu1.5 |
| php5 | 14.10 utopic | Fixed 5.5.12+dfsg-2ubuntu4.1 |
| 14.04 LTS trusty | Fixed 5.5.9+dfsg-1ubuntu4.5 |
| 12.04 LTS precise | Fixed 5.3.10-1ubuntu3.15 |
| 10.04 LTS lucid | Fixed 5.3.2-1ubuntu4.28 |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2014-3710?format=md#patch-details)

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| file | * Upstream:   [39c7ac1](https://github.com/file/file/commit/39c7ac1106be844a5296d3eb5971946cc09ffda0) |
| php5 | * Upstream:   <http://git.php.net/?p=php-src.git;a=commit;h=1803228597e82218a8c105e67975bc50e6f5bf0d> * Upstream:   <http://git.php.net/?p=php-src.git;a=commit;h=5b295bf19161b14d6c81151fd89c2f17bd50525c> * Upstream:   <http://git.php.net/?p=php-src.git;a=commit;h=1803228597e82218a8c105e67975bc50e6f5bf0d> |

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3710)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-3710)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2014-3710)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2014-3710)

### Related Ubuntu Security Notices (USN)

+ [USN-2494-1](https://usn.ubuntu.com/USN-2494-1)
+ file vulnerabilities
+ 4 February 2015

+ [USN-2391-1](https://usn.ubuntu.com/USN-2391-1)
+ php5 vulnerabilities
+ 30 October 2014

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2014-3710>