Read the docs
TI-2014-02864 Aliases CVE-2014-3538GHSA-p2f8-8pr7-gprp

file before 5.19 does not properly restrict the amount of data read during a regex…

Priority LOW 36CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.

Why it matters now

EPSS 0.11814 96th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD
Fix Fixed Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:christos_zoulas:file:*:*:*:*:*:*:*:*up to 5.18VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.00:*:*:*:*:*:*:*5.00VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.01:*:*:*:*:*:*:*5.01VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.02:*:*:*:*:*:*:*5.02VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.03:*:*:*:*:*:*:*5.03VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.04:*:*:*:*:*:*:*5.04VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.05:*:*:*:*:*:*:*5.05VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.06:*:*:*:*:*:*:*5.06VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.07:*:*:*:*:*:*:*5.07VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.08:*:*:*:*:*:*:*5.08VulnerableChristos Zoulas
  • cpe:2.3:a:christos_zoulas:file:*:*:*:*:*:*:*:* Versions up to 5.18 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.00:*:*:*:*:*:*:* Versions 5.00 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.01:*:*:*:*:*:*:* Versions 5.01 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.02:*:*:*:*:*:*:* Versions 5.02 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.03:*:*:*:*:*:*:* Versions 5.03 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.04:*:*:*:*:*:*:* Versions 5.04 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.05:*:*:*:*:*:*:* Versions 5.05 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.06:*:*:*:*:*:*:* Versions 5.06 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.07:*:*:*:*:*:*:* Versions 5.07 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.08:*:*:*:*:*:*:* Versions 5.08 Vulnerable ·Christos Zoulas
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:christos_zoulas:file:5.09:*:*:*:*:*:*:*5.09VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.10:*:*:*:*:*:*:*5.10VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.11:*:*:*:*:*:*:*5.11VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.12:*:*:*:*:*:*:*5.12VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.13:*:*:*:*:*:*:*5.13VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.14:*:*:*:*:*:*:*5.14VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.15:*:*:*:*:*:*:*5.15VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.16:*:*:*:*:*:*:*5.16VulnerableChristos Zoulas
cpe:2.3:a:christos_zoulas:file:5.17:*:*:*:*:*:*:*5.17VulnerableChristos Zoulas
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*5.4.0 to before 5.4.32; 5.5.0 to before 5.5.16VulnerablePHP
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*7.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
  • cpe:2.3:a:christos_zoulas:file:5.09:*:*:*:*:*:*:* Versions 5.09 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.10:*:*:*:*:*:*:* Versions 5.10 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.11:*:*:*:*:*:*:* Versions 5.11 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.12:*:*:*:*:*:*:* Versions 5.12 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.13:*:*:*:*:*:*:* Versions 5.13 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.14:*:*:*:*:*:*:* Versions 5.14 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.15:*:*:*:*:*:*:* Versions 5.15 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.16:*:*:*:*:*:*:* Versions 5.16 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:christos_zoulas:file:5.17:*:*:*:*:*:*:* Versions 5.17 Vulnerable ·Christos Zoulas
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 5.4.0 to before 5.4.32; 5.5.0 to before 5.5.16 Vulnerable ·PHP
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian

Remediation

Red Hat 5 advisories

  • RHSA-2016:0760 Released 2016-05-10 · Red Hat rating Moderate
    file security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Desktop (v. 6) file-5.04-30.el6, file-libs-5.04-30.el6, python-magic-5.04-30.el6
    • Red Hat Enterprise Linux Desktop Optional (v. 6) file-devel-5.04-30.el6, file-static-5.04-30.el6
    • Red Hat Enterprise Linux HPC Node (v. 6) file-5.04-30.el6, file-libs-5.04-30.el6, python-magic-5.04-30.el6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) file-devel-5.04-30.el6, file-static-5.04-30.el6
    • Red Hat Enterprise Linux Server (v. 6) file-5.04-30.el6, file-devel-5.04-30.el6, file-devel-5.04-30.el6.ppc +3
    • Red Hat Enterprise Linux Server Optional (v. 6) file-static-5.04-30.el6
    • Red Hat Enterprise Linux Workstation (v. 6) file-5.04-30.el6, file-devel-5.04-30.el6, file-libs-5.04-30.el6 +1
    • Red Hat Enterprise Linux Workstation Optional (v. 6) file-static-5.04-30.el6
  • RHSA-2015:2155 Released 2015-11-19 · Red Hat rating Moderate
    file security and bug fix update
    • Red Hat Enterprise Linux Client (v. 7) file-5.11-31.el7, file-libs-5.11-31.el7, python-magic-5.11-31.el7
    • Red Hat Enterprise Linux Client Optional (v. 7) file-devel-5.11-31.el7, file-static-5.11-31.el7
    • Red Hat Enterprise Linux ComputeNode (v. 7) file-5.11-31.el7, file-libs-5.11-31.el7, python-magic-5.11-31.el7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) file-devel-5.11-31.el7, file-static-5.11-31.el7
    • Red Hat Enterprise Linux Server (v. 7) file-5.11-31.el7, file-libs-5.11-31.el7, file-libs-5.11-31.el7.ppc +1
    • Red Hat Enterprise Linux Server Optional (v. 7) file-devel-5.11-31.el7, file-devel-5.11-31.el7.ppc, file-static-5.11-31.el7 +1
    • Red Hat Enterprise Linux Workstation (v. 7) file-5.11-31.el7, file-libs-5.11-31.el7, python-magic-5.11-31.el7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) file-devel-5.11-31.el7, file-static-5.11-31.el7
  • RHSA-2014:1765 Released 2014-10-30 · Red Hat rating Important
    php54-php security update
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) php54-php-5.4.16-22.el6, php54-php-bcmath-5.4.16-22.el6, php54-php-cli-5.4.16-22.el6 +22
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) php54-php-5.4.16-22.el7, php54-php-bcmath-5.4.16-22.el7, php54-php-cli-5.4.16-22.el7 +20
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) php54-php-5.4.16-22.el6, php54-php-bcmath-5.4.16-22.el6, php54-php-cli-5.4.16-22.el6 +22
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5) php54-php-5.4.16-22.el6, php54-php-bcmath-5.4.16-22.el6, php54-php-cli-5.4.16-22.el6 +22
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6) php54-php-5.4.16-22.el6, php54-php-bcmath-5.4.16-22.el6, php54-php-cli-5.4.16-22.el6 +22
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) php54-php-5.4.16-22.el6, php54-php-bcmath-5.4.16-22.el6, php54-php-cli-5.4.16-22.el6 +22
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) php54-php-5.4.16-22.el7, php54-php-bcmath-5.4.16-22.el7, php54-php-cli-5.4.16-22.el7 +20
Show 2 more Red Hat advisories
  • RHSA-2014:1766 Released 2014-10-30 · Red Hat rating Important
    php55-php security update
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) php55-php-5.5.6-13.el6, php55-php-bcmath-5.5.6-13.el6, php55-php-cli-5.5.6-13.el6 +24
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) php55-php-5.5.6-13.el7, php55-php-bcmath-5.5.6-13.el7, php55-php-cli-5.5.6-13.el7 +22
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) php55-php-5.5.6-13.el6, php55-php-bcmath-5.5.6-13.el6, php55-php-cli-5.5.6-13.el6 +24
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5) php55-php-5.5.6-13.el6, php55-php-bcmath-5.5.6-13.el6, php55-php-cli-5.5.6-13.el6 +24
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6) php55-php-5.5.6-13.el6, php55-php-bcmath-5.5.6-13.el6, php55-php-cli-5.5.6-13.el6 +24
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) php55-php-5.5.6-13.el6, php55-php-bcmath-5.5.6-13.el6, php55-php-cli-5.5.6-13.el6 +24
    • Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) php55-php-5.5.6-13.el7, php55-php-bcmath-5.5.6-13.el7, php55-php-cli-5.5.6-13.el7 +22
  • RHSA-2014:1327 Released 2014-09-30 · Red Hat rating Moderate
    php security update
    • Red Hat Enterprise Linux Client Optional (v. 7) php-5.4.16-23.el7_0.1, php-bcmath-5.4.16-23.el7_0.1, php-cli-5.4.16-23.el7_0.1 +22
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) php-5.4.16-23.el7_0.1, php-bcmath-5.4.16-23.el7_0.1, php-cli-5.4.16-23.el7_0.1 +22
    • Red Hat Enterprise Linux Server (v. 7) php-5.4.16-23.el7_0.1, php-cli-5.4.16-23.el7_0.1, php-common-5.4.16-23.el7_0.1 +11
    • Red Hat Enterprise Linux Server Optional (v. 7) php-bcmath-5.4.16-23.el7_0.1, php-dba-5.4.16-23.el7_0.1, php-devel-5.4.16-23.el7_0.1 +8
    • Red Hat Enterprise Linux Workstation (v. 7) php-5.4.16-23.el7_0.1, php-cli-5.4.16-23.el7_0.1, php-common-5.4.16-23.el7_0.1 +11
    • Red Hat Enterprise Linux Workstation Optional (v. 7) php-bcmath-5.4.16-23.el7_0.1, php-dba-5.4.16-23.el7_0.1, php-devel-5.4.16-23.el7_0.1 +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2015:2155
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2014:1327, RHSA-2015:2155
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2015:2155
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2014:1327, RHSA-2015:2155
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2016:0760
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2016:0760
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2016:0760
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2016:0760
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2016:0760
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2014:1327, RHSA-2015:2155
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2016:0760
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2014:1327, RHSA-2015:2155
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2016:0760
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2014:1327, RHSA-2015:2155
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2016:0760
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2014:1327, RHSA-2015:2155
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:1765, RHSA-2014:1766
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2014:1765, RHSA-2014:1766
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4)Fixed RHSA-2014:1765, RHSA-2014:1766
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5)Fixed RHSA-2014:1765, RHSA-2014:1766
Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6)Fixed RHSA-2014:1765, RHSA-2014:1766
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:1765, RHSA-2014:1766
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2014:1765, RHSA-2014:1766
Not affected: 2 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-3538
  2. 2026-10-03 Alias added: GHSA-p2f8-8pr7-gprp

References

Exploit 4

Patch 2

Advisory 13

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences