cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-magicUpgrade file-libsUpgrade fileUpgrade file-devel | May 4, 2022 | Oct 21, 2019 |
| Alpine Linux | — | Upgrade file | Nov 27, 2019 | Oct 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade python-magicUpgrade file-debuginfoUpgrade file-develUpgrade file-libsUpgrade file-staticUpgrade file | Apr 27, 2020 | Oct 21, 2019 |
| Amazon_linux | — | Upgrade fileUpgrade php72Upgrade php73 | Dec 20, 2019 | Oct 21, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 21, 2019 |
| Centos_linux | — | Upgrade file-libs-debuginfoUpgrade file-debugsourceUpgrade python3-magicUpgrade file-libsUpgrade fileUpgrade file-debuginfo | Nov 10, 2021 | Oct 21, 2019 |
| Debian | — | Upgrade file | Oct 25, 2019 | Oct 21, 2019 |
| Gentoo Linux | — | Upgrade sys-apps/file. | Mar 16, 2020 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade fileUpgrade file-libsUpgrade python-magic | Dec 4, 2019 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-magicUpgrade fileUpgrade file-libs | Apr 16, 2020 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade file-libsUpgrade fileUpgrade python-magic | Dec 11, 2019 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade fileUpgrade file-libsUpgrade python3-magic | Nov 28, 2019 | Oct 21, 2019 |
| Oracle Solaris | — | Upgrade web/php-71 to version 7.1.33-11.4.16.0.1.3.0 on Solaris 11.4Upgrade web/php-56 to version 5.6.39-0.175.3.36.0.19.0 on Solaris 11.3Upgrade web/php-71 to version 7.1.25-0.175.3.36.0.19.0 on Solaris 11.3Upgrade web/php-73 to version 7.3.11-11.4.16.0.1.3.0 on Solaris 11.4 | Dec 18, 2019 | Oct 21, 2019 |
| Oracle_linux | — | Upgrade file-libsUpgrade file-develUpgrade fileUpgrade python3-magic | Nov 17, 2021 | Aug 26, 2019 |
| Redhat_linux | — | Upgrade fileUpgrade python3-magicUpgrade file-debugsourceUpgrade file-libsUpgrade file-develUpgrade file-debuginfoUpgrade file-libs-debuginfo | Nov 10, 2021 | Oct 21, 2019 |
| Rocky_linux | — | Upgrade file-debugsourceUpgrade file-debuginfoUpgrade fileUpgrade file-libsUpgrade file-develUpgrade file-libs-debuginfo | Mar 12, 2024 | Oct 21, 2019 |
| Suse | — | Upgrade python3-magicUpgrade libmagic1Upgrade file-magicUpgrade python2-magicUpgrade python-magicUpgrade file-develUpgrade file-devel-32bitUpgrade libmagic1-32bitUpgrade file | May 23, 2020 | Oct 21, 2019 |
| Ubuntu | — | Upgrade file (Ubuntu Pro)Upgrade libmagic1Upgrade fileUpgrade libmagic1 (Ubuntu Pro) | Oct 31, 2019 | Oct 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub