cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade file-develUpgrade fileUpgrade file-libsUpgrade python3-magic | May 4, 2022 | Oct 21, 2019 |
| Alpine Linux | — | Upgrade file | Nov 27, 2019 | Oct 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade file-libsUpgrade fileUpgrade file-staticUpgrade file-debuginfoUpgrade python-magicUpgrade file-devel | Apr 27, 2020 | Oct 21, 2019 |
| Amazon_linux | — | Upgrade fileUpgrade php73Upgrade php72 | Dec 20, 2019 | Oct 21, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 21, 2019 |
| Centos_linux | — | Upgrade file-debugsourceUpgrade file-libs-debuginfoUpgrade python3-magicUpgrade file-debuginfoUpgrade fileUpgrade file-libs | Nov 10, 2021 | Oct 21, 2019 |
| Debian | — | Upgrade file | Oct 25, 2019 | Oct 21, 2019 |
| Gentoo Linux | — | Upgrade sys-apps/file. | Mar 16, 2020 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-magicUpgrade fileUpgrade file-libs | Dec 4, 2019 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade fileUpgrade python-magicUpgrade file-libs | Apr 16, 2020 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade fileUpgrade python-magicUpgrade file-libs | Dec 11, 2019 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-magicUpgrade file-libsUpgrade file | Nov 28, 2019 | Oct 21, 2019 |
| Oracle Solaris | — | Upgrade web/php-71 to version 7.1.25-0.175.3.36.0.19.0 on Solaris 11.3Upgrade web/php-73 to version 7.3.11-11.4.16.0.1.3.0 on Solaris 11.4Upgrade web/php-56 to version 5.6.39-0.175.3.36.0.19.0 on Solaris 11.3Upgrade web/php-71 to version 7.1.33-11.4.16.0.1.3.0 on Solaris 11.4 | Dec 18, 2019 | Oct 21, 2019 |
| Oracle_linux | — | Upgrade python3-magicUpgrade file-develUpgrade fileUpgrade file-libs | Nov 17, 2021 | Aug 26, 2019 |
| Redhat_linux | — | Upgrade file-debugsourceUpgrade python3-magicUpgrade file-libsUpgrade file-develUpgrade fileUpgrade file-debuginfoUpgrade file-libs-debuginfo | Nov 10, 2021 | Oct 21, 2019 |
| Rocky_linux | — | Upgrade file-debuginfoUpgrade file-libsUpgrade file-debugsourceUpgrade fileUpgrade file-libs-debuginfoUpgrade file-devel | Mar 12, 2024 | Oct 21, 2019 |
| Suse | — | Upgrade file-magicUpgrade python3-magicUpgrade python-magicUpgrade python2-magicUpgrade libmagic1Upgrade fileUpgrade file-devel-32bitUpgrade libmagic1-32bitUpgrade file-devel | May 23, 2020 | Oct 21, 2019 |
| Ubuntu | — | Upgrade libmagic1 (Ubuntu Pro)Upgrade fileUpgrade file (Ubuntu Pro)Upgrade libmagic1 | Oct 31, 2019 | Oct 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub