Date:         Mon, 3 Nov 2014 17:55:22 +0000
Reply-To:     scientific-linux-users@listserv.fnal.gov
Sender:       Security Errata for Scientific Linux
              
From:         Pat Riehecky 
Subject:      Security ERRATA Moderate: file on SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis:          Moderate: file security and bug fix update
Advisory ID:       SLSA-2014:1606-2
Issue Date:        2014-10-14
CVE Numbers:       CVE-2012-1571
                   CVE-2014-1943
                   CVE-2014-2270
                   CVE-2014-0238
                   CVE-2014-0237
                   CVE-2014-3480
                   CVE-2014-3479
--

Multiple denial of service flaws were found in the way file parsed certain
Composite Document Format (CDF) files. A remote attacker could use either
of these flaws to crash file, or an application using file, via a
specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479,
CVE-2014-3480, CVE-2012-1571)

Two denial of service flaws were found in the way file handled indirect
and search rules. A remote attacker could use either of these flaws to
cause file, or an application using file, to crash or consume an excessive
amount of CPU. (CVE-2014-1943, CVE-2014-2270)

This update also fixes the following bugs:

* Previously, the output of the "file" command contained redundant white
spaces. With this update, the new STRING_TRIM flag has been introduced to
remove the unnecessary white spaces.

* Due to a bug, the "file" command could incorrectly identify an XML
document as a LaTex document. The underlying source code has been modified
to fix this bug and the command now works as expected.

* Previously, the "file" command could not recognize .JPG files and
incorrectly labeled them as "Minix filesystem". This bug has been fixed
and the command now properly detects .JPG files.

* Under certain circumstances, the "file" command incorrectly detected
NETpbm files as "x86 boot sector". This update applies a patch to fix this
bug and the command now detects NETpbm files as expected.

* Previously, the "file" command incorrectly identified ASCII text files
as a .PIC image file. With this update, a patch has been provided to
address this bug and the command now correctly recognizes ASCII text
files.

* On 32-bit PowerPC systems, the "from" field was missing from the output
of the "file" command. The underlying source code has been modified to fix
this bug and "file" output now contains the "from" field as expected.

* The "file" command incorrectly detected text files as "RRDTool DB
version ool - Round Robin Database Tool". This update applies a patch to
fix this bug and the command now correctly detects text files.

* Previously, the "file" command supported only version 1 and 2 of the
QCOW format. As a consequence, file was unable to detect a "qcow2
compat=1.1" file created on Scientific Linux 7. With this update, support
for QCOW version 3 has been added so that the command now detects such
files as expected.
--

SL6
  x86_64
    file-5.04-21.el6.x86_64.rpm
    file-debuginfo-5.04-21.el6.i686.rpm
    file-debuginfo-5.04-21.el6.x86_64.rpm
    file-libs-5.04-21.el6.i686.rpm
    file-libs-5.04-21.el6.x86_64.rpm
    file-devel-5.04-21.el6.i686.rpm
    file-devel-5.04-21.el6.x86_64.rpm
    file-static-5.04-21.el6.x86_64.rpm
    python-magic-5.04-21.el6.x86_64.rpm
  i386
    file-5.04-21.el6.i686.rpm
    file-debuginfo-5.04-21.el6.i686.rpm
    file-libs-5.04-21.el6.i686.rpm
    file-devel-5.04-21.el6.i686.rpm
    file-static-5.04-21.el6.i686.rpm
    python-magic-5.04-21.el6.i686.rpm

- Scientific Linux Development Team