Name: CVE-2017-1000249: Improper Restriction of Operations within the Bounds of a Memory Buffer
Creator: Rapid7
Published: 2017-09-11T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2017-1000249, CWE-119, CVSS 5.5, EPSS 0.00138

An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793 (Aug 2017).

CVSS Details

CVSS 3.0 Base Score: 5.5
CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alpine Linux	—	Upgrade file	Sep 20, 2017	Sep 11, 2017
Amazon_linux	—	Upgrade file	Oct 3, 2017	Sep 11, 2017
Debian	—	Upgrade file	Dec 5, 2017	Sep 5, 2017
Gentoo Linux	—	Upgrade sys-apps/file.	Oct 30, 2017	Sep 11, 2017
Suse	—	Upgrade libmagic1-32bitUpgrade fileUpgrade file-develUpgrade libmagic1Upgrade file-magic	May 20, 2018	Sep 11, 2017
Ubuntu	—	Upgrade fileUpgrade libmagic1	Dec 20, 2017	Sep 7, 2017

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence