Stack out-of-bounds read in file - CVE-2019-8904

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive information or perform a denial of service (DoS) attack.

The vulnerability exists due to stack-based buffer over-read in the do_core_note function, as defined in the readelf.c source code file. A remote attacker can trick the victim into executing a file that submits malicious input to the targeted system with the file command, trigger memory corruption and gain access to arbitrary data or perform a denial of service attack.

Affected software

How to mitigate CVE-2019-8904

External References

• https://bugs.astron.com/view.php?id=62

Related Security Bulletins

• Multiple vulnerabilities in Astron Software file
• Ubuntu update for file
• Arch Linux update for file
• Amazon Linux AMI update for file
• Stack out-of-bounds read in file (Alpine package)
• Fedora 29 update for file