Red Hat Security AdvisoryRHSA-2016:0760
file security, bug fix, and enhancement update
Released 2016-05-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) file-5.04-30.el6, file-libs-5.04-30.el6, python-magic-5.04-30.el6
- Red Hat Enterprise Linux Desktop Optional (v. 6) file-devel-5.04-30.el6, file-static-5.04-30.el6
- Red Hat Enterprise Linux HPC Node (v. 6) file-5.04-30.el6, file-libs-5.04-30.el6, python-magic-5.04-30.el6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) file-devel-5.04-30.el6, file-static-5.04-30.el6
- Red Hat Enterprise Linux Server (v. 6) file-5.04-30.el6, file-devel-5.04-30.el6, file-devel-5.04-30.el6.ppc +3
- Red Hat Enterprise Linux Server Optional (v. 6) file-static-5.04-30.el6
- Red Hat Enterprise Linux Workstation (v. 6) file-5.04-30.el6, file-devel-5.04-30.el6, file-libs-5.04-30.el6 +1
- Red Hat Enterprise Linux Workstation Optional (v. 6) file-static-5.04-30.el6
Fixes 7 records
Priority MEDIUM 40
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, w…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.04648 · Published 2015-03-30 · Partial fix CWE-20
Priority LOW 39
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.20237 · Published 2014-08-23 · Fixed CWE-189
Priority LOW 38
The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.14013 · Published 2014-11-05 · Partial fix CWE-20
Priority LOW 36
file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.11814 · Published 2014-07-03 · Fixed CWE-399
Priority LOW 32
softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.05926 · Published 2014-12-17 · Partial fix CWE-399
Priority LOW 30
The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large number of notes.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.04683 · Published 2015-01-21 · Partial fix CWE-399
Priority LOW 30
The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.04432 · Published 2014-12-17 · Partial fix CWE-399
THREATIST.IORead the docs