CVE-2014-3538: Christos Zoulas File

Medium severity, CVSS 5.0. EPSS: 11.8% chance of exploitation in the next 30 days.

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.

Affected products

• Christos Zoulas File: up to and including 5.18; version 5.00 only; version 5.01 only; version 5.02 only; version 5.03 only; version 5.04 only; …
• Debian Debian Linux: version 7.0 only; version 8.0 only
• PHP PHP: from 5.4.0, before 5.4.32 (fixed in 5.4.32); from 5.5.0, before 5.5.16 (fixed in 5.5.16)

Published 2014-07-03. Last modified 2026-06-17.