Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 11 articles for you...
89
security advisorybuffer overflowFedoraFedora: FEDORA-2019-18036b898e Critical: File Heap Overflow Fix
- fix heap-based buffer overflow in cdf_read_property_info() (CVE-2019-18218). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-18036b898e 2019-11-10 01:06:02.434237 --------------------------------------------------------------------------------Name : file Product : Fedora 29 Version : 5.34 Release : 15.fc29 URL : https://www.darwinsys.com/file/ Summary : A utility for determining file types Description : The file command is used to identify a particular file according to the type of data contained by the file. File can identify many different file types, including ELF binaries, system libraries, RPM packages, and different graphics formats. --------------------------------------------------------------------------------Update Information: - fix heap-based buffer overflow in cdf_read_property_info() (CVE-2019-18218) --------------------------------------------------------------------------------ChangeLog: * Fri Oct 25 2019 Kamil Dudka - 5.34-15 - fix heap-based buffer overflow in cdf_read_property_info() (CVE-2019-18218) * Tue Jun 11 2019 Kamil Dudka - 5.34-14 - fix double free on read error (#1685217) * Fri Mar 1 2019 Kamil Dudka - 5.34-13 - improve support for Apple formats (#1679455) * Mon Feb 25 2019 Kamil Dudka - 5.34-12 - remote denial of service in do_core_note in readelf.c (CVE-2019-8907) - stack-based buffer over-read in do_core_note in readelf.c (CVE-2019-8905) - stack-based buffer over-read in do_bid_note in readelf.c (CVE-2019-8904) - out-of-bounds read in do_core_note in readelf.c (CVE-2019-8906) * Thu Jan 24 2019 Ondrej Dubaj - 5.34-9 - Added Linux PowerPC core offsets for Linux + fixed bug #1161911 * Thu Jan 24 2019 Ondrej Dubaj - 5.34-8 - Fixed bug missidentifying netpbm files (#856092) * Tue Dec 4 2018 Ondrej Dubaj - 5.34-7 - Fixed bug misleading qcow2 v2 and v3 files (#1654349) - Changed bug report URL * Wed Nov 21 2018 Ondrej Dubaj - 5.34-6 - Fixed missidentifying locale files bug (#1527398) * Wed Nov 14 2018 Kamil Dudka - 5.34-5 - reintroduce the python2-magic subpackage needed by python2-bugzilla (#1649547) * Mon Nov 12 2018 Kamil Dudka - 5.34-4 - add magic for eBPF objects (#1648667) --------------------------------------------------------------------------------References: [ 1 ] Bug #1765273 - CVE-2019-18218 file: heap-based buffer overflow in cdf_read_property_info in cdf.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1765273 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-18036b898e' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Nov 09, 2019
•Critical
Fedora
89
security advisorybuffer overflowFedoraFedora 30: FEDORA-2019-97dcb2762a Moderate: Fix Heap Overflow
- fix heap-based buffer overflow in cdf_read_property_info() (CVE-2019-18218). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-97dcb2762a 2019-11-03 00:10:34.338463 --------------------------------------------------------------------------------Name : file Product : Fedora 30 Version : 5.36 Release : 5.fc30 URL : https://www.darwinsys.com/file/ Summary : A utility for determining file types Description : The file command is used to identify a particular file according to the type of data contained by the file. File can identify many different file types, including ELF binaries, system libraries, RPM packages, and different graphics formats. --------------------------------------------------------------------------------Update Information: - fix heap-based buffer overflow in cdf_read_property_info() (CVE-2019-18218) --------------------------------------------------------------------------------ChangeLog: * Fri Oct 25 2019 Kamil Dudka - 5.36-5 - fix heap-based buffer overflow in cdf_read_property_info() (CVE-2019-18218) * Fri Aug 30 2019 Kamil Dudka - 5.36-4 - avoid running librpm's exit handler in a forked process (#1705320) * Tue Jun 11 2019 Kamil Dudka - 5.36-3 - fix double free on read error (#1685217) --------------------------------------------------------------------------------References: [ 1 ] Bug #1765273 - CVE-2019-18218 file: heap-based buffer overflow in cdf_read_property_info in cdf.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1765273 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-97dcb2762a' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. Moredetails on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Nov 02, 2019
Fedora
91
security advisorydenial of servicegentooGentoo 201806-08 Security Update: File Denial Of Service Vulnerability
A vulnerability in file could lead to a Denial of Service condition.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201806-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: file: Denial of service Date: June 23, 2018 Bugs: #657930 ID: 201806-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in file could lead to a Denial of Service condition. Background ========= file is a utility that guesses a file format by scanning binary data for patterns. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/file < 5.33-r2 > = 5.33-r2 Description ========== File does not properly utilize the do_core_note function in readelf.c in libmagic.a. Impact ===== A remote attacker could send a specially crafted ELF file possibly resulting in a Denial of Service condition. Workaround ========= There is no known workaround at this time. Resolution ========= All file users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =sys-apps/file-5.33-r2" References ========= [ 1 ] CVE-2018-10360 https://nvd.nist.gov/vuln/detail/CVE-2018-10360 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201806-08 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns shouldbe addressed to
Jun 23, 2018
Gentoo
89
security advisorybuffer overflowFedoraFedora 27: 2017-6a10869603 Moderate: File Buffer Overflow
- fix a possible stack based buffer overflow (CVE-2017-1000249). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-6a10869603 2017-09-30 05:57:53.233012 --------------------------------------------------------------------------------Name : file Product : Fedora 27 Version : 5.31 Release : 10.fc27 URL : https://www.darwinsys.com/file/ Summary : A utility for determining file types Description : The file command is used to identify a particular file according to the type of data contained by the file. File can identify many different file types, including ELF binaries, system libraries, RPM packages, and different graphics formats. --------------------------------------------------------------------------------Update Information: - fix a possible stack based buffer overflow (CVE-2017-1000249) --------------------------------------------------------------------------------References: [ 1 ] Bug #1488575 - CVE-2017-1000249 file: Stack-based buffer overflow in do_bid_note() [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1488575 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade file' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Sep 30, 2017
•Important
Fedora
172
security advisorydenial of servicecriticalUbuntu 20.04: USN-4032-1 Important: Image Processing Denial of Service
The file utility could be made to crash if it opened a speciallycrafted file.. =========================================================================Ubuntu Security Notice USN-3412-1 September 07, 2017 file vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.04 Summary: The file utility could be made to crash if it opened a specially crafted file. Software Description: - file: Tool to determine file types Details: Thomas Jarosch discovered that file incorrectly handled certain ELF files. An attacker could use this to cause file to crash, resulting in a denial of service. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 17.04: file 1:5.29-3ubuntu0.1 libmagic1 1:5.29-3ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-3412-1 CVE-2017-1000249 Package Information: https://launchpad.net/ubuntu/+source/file/1:5.29-3ubuntu0.1 . Critical notification regarding a vulnerability in Ubuntu 17.04's file handling that could result in service disruption through specially crafted files. Update is accessible immediately.. Ubuntu Security Notice, File Utility Issue, Denial Of Service, Security Update. . Severity: Important. LinuxSecurity.com Team
Sep 07, 2017
•Important
Ubuntu
91
security advisoryGentoosecurity issueGentoo 201701-42 Moderate: File Remote Code Execution Risk Alert
Multiple vulnerabilities have been found in file, the worst of which could allow remote attackers to execute arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201701-42 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: file: Multiple vulnerabilities Date: January 17, 2017 Bugs: #526544, #538660, #539106, #579306 ID: 201701-42 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been found in file, the worst of which could allow remote attackers to execute arbitrary code. Background ========= file is a utility that guesses a file format by scanning binary data for patterns. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/file < 5.23 > = 5.23 Description ========== Multiple vulnerabilities have been discovered in file. Please review the CVE identifiers referenced below for details. Impact ===== A remote attacker could entice a user or automated system to process a specially crafted input file, possibly resulting in execution of arbitrary code with the privileges of the process, a Denial of Service condition or have other unspecified impacts. Workaround ========= There is no known workaround at this time. Resolution ========= All file users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =sys-apps/file-5.23" References ========= [ 1 ] CVE-2014-3710 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3710 [ 2 ] CVE-2014-9652 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9652 [ 3 ] CVE-2014-9653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9653 [ 4 ] CVE-2015-8865 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8865 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201701-42 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Jan 17, 2017
Gentoo
91
security advisorydenial of servicegentooGentoo: GLSA-201503-08 Normal: Security Flaw in File Utility
Vulnerabilities in file could allow a context-dependent attack to create a Denial of Service condition.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201503-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: file: Denial of Service Date: March 16, 2015 Bugs: #503582, #532768 ID: 201503-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Vulnerabilities in file could allow a context-dependent attack to create a Denial of Service condition. Background ========= The file utility attempts to identify a file’s format by scanning binary data for patterns. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/file < 5.22 > = 5.22 Description ========== Multiple issues with the ELF parser used by the file utility have been detected and fixed. Impact ===== A context-dependent attacker can cause Denial of Service. Workaround ========= There is no known workaround at this time. Resolution ========= All file users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =sys-apps/file-5.22" References ========= [ 1 ] CVE-2014-2270 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2270 [ 2 ] CVE-2014-9620 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9620 [ 3 ] CVE-2014-9621 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9621 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201503-08 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Mar 16, 2015
Gentoo
91
security advisorydenial of servicegentooUbuntu: 202205-10 Critical Alert for System Resource Exhaustion Issue
A vulnerability in file could allow a context-dependent attack to create a Denial of Service condition.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201412-48 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: file: Denial of Service Date: December 27, 2014 Bugs: #532686 ID: 201412-48 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in file could allow a context-dependent attack to create a Denial of Service condition. Background ========= The file utility attempts to identify a file's format by scanning binary data for patterns. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/file < 5.21 > = 5.21 Description ========== An issue with the ELF parser used by the file utility can cause a resource consumption when reading a specially-crafted ELF binary. Impact ===== A context-dependent attacker may be able to cause Denial of Service. Workaround ========= There is no known workaround at this time. Resolution ========= All file users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =sys-apps/file-5.21" References ========= [ 1 ] CVE-2014-8117 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8117 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201412-48 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality andsecurity of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Dec 27, 2014
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!