Stack-based buffer overflow in file - CVE-2019-8907
Published: February 21, 2019
Vulnerability identifier: #VU17822
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-8907
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to stack-based buffer overflow in the do_core_note function. A remote attacker can trick the victim into executing a file that submits malicious input to the targeted system with the file command, trigger memory corruption and perform a denial of service attack.
Affected software
file
Arch Linux
Amazon Linux AMI
Slackware Linux
Opensuse
Fedora
file (Ubuntu package)
file (Alpine package)
file
Arch Linux
Amazon Linux AMI
Slackware Linux
Opensuse
Fedora
file (Ubuntu package)
file (Alpine package)
file
How to mitigate CVE-2019-8907
Update to version 5.36.
file - update to 5.36
file (Ubuntu package) - addressed in versions 1:5.25-2ubuntu1.2, 1:5.32-2ubuntu0.2, 1:5.34-2ubuntu0.1
file (Alpine package) - update to 5.32-r1
file - addressed in versions 5.33-10.fc28, 5.34-12.fc29
file (Ubuntu package) - addressed in versions 1:5.25-2ubuntu1.2, 1:5.32-2ubuntu0.2, 1:5.34-2ubuntu0.1
file (Alpine package) - update to 5.32-r1
file - addressed in versions 5.33-10.fc28, 5.34-12.fc29
External References
Related Security Bulletins
- Multiple vulnerabilities in Astron Software file
- Ubuntu update for file
- OpenSUSE Linux update for file
- Arch Linux update for file
- OpenSUSE Linux update for file
- Amazon Linux AMI update for file
- Slackware Linux update for file
- Stack-based buffer overflow in file (Alpine package)
- Fedora 29 update for file
- Fedora 28 update for file