Red Hat Security AdvisoryRHSA-2014:1606
file security and bug fix update
Released 2014-10-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) file-5.04-21.el6, file-libs-5.04-21.el6
- Red Hat Enterprise Linux Desktop Optional (v. 6) file-devel-5.04-21.el6, file-static-5.04-21.el6, python-magic-5.04-21.el6
- Red Hat Enterprise Linux HPC Node (v. 6) file-5.04-21.el6, file-libs-5.04-21.el6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) file-devel-5.04-21.el6, file-static-5.04-21.el6, python-magic-5.04-21.el6
- Red Hat Enterprise Linux Server (v. 6) file-5.04-21.el6, file-devel-5.04-21.el6, file-devel-5.04-21.el6.ppc +3
- Red Hat Enterprise Linux Server Optional (v. 6) file-static-5.04-21.el6
- Red Hat Enterprise Linux Workstation (v. 6) file-5.04-21.el6, file-devel-5.04-21.el6, file-libs-5.04-21.el6 +1
- Red Hat Enterprise Linux Workstation Optional (v. 6) file-static-5.04-21.el6
Fixes 7 records
Priority MEDIUM 42
The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to ca…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.11481 · Published 2014-07-09 · Fixed CWE-20
Priority MEDIUM 42
The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.20805 · Published 2014-06-01 · Fixed CWE-119
Priority MEDIUM 41
The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.19877 · Published 2014-06-01 · Fixed CWE-399
Priority LOW 36
The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to ca…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.14927 · Published 2014-07-09 · Fixed
Priority LOW 36
file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.04117 · Published 2012-07-17 · Fixed CWE-125
Priority LOW 31
Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.05028 · Published 2014-02-18 · Partial fix CWE-755
Priority LOW 27
softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.04318 · Published 2014-03-14 · Partial fix CWE-119
THREATIST.IORead the docs