cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-magicUpgrade fileUpgrade file-libsUpgrade file-devel | May 4, 2022 | Oct 21, 2019 |
| Alpine Linux | — | Upgrade file | Nov 27, 2019 | Oct 21, 2019 |
| Amazon Linux Ami 2 | — | Upgrade fileUpgrade file-staticUpgrade file-libsUpgrade file-develUpgrade python-magicUpgrade file-debuginfo | Apr 27, 2020 | Oct 21, 2019 |
| Amazon_linux | — | Upgrade fileUpgrade php73Upgrade php72 | Dec 20, 2019 | Oct 21, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Oct 21, 2019 |
| Centos_linux | — | Upgrade file-debugsourceUpgrade file-libs-debuginfoUpgrade file-libsUpgrade file-debuginfoUpgrade python3-magicUpgrade file | Nov 10, 2021 | Oct 21, 2019 |
| Debian | — | Upgrade file | Oct 25, 2019 | Oct 21, 2019 |
| Gentoo Linux | — | Upgrade sys-apps/file. | Mar 16, 2020 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-magicUpgrade file-libsUpgrade file | Dec 4, 2019 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade file-libsUpgrade fileUpgrade python-magic | Apr 16, 2020 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade file-libsUpgrade fileUpgrade python-magic | Dec 11, 2019 | Oct 21, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-magicUpgrade file-libsUpgrade file | Nov 28, 2019 | Oct 21, 2019 |
| Oracle Solaris | — | Upgrade web/php-71 to version 7.1.33-11.4.16.0.1.3.0 on Solaris 11.4Upgrade web/php-56 to version 5.6.39-0.175.3.36.0.19.0 on Solaris 11.3Upgrade web/php-71 to version 7.1.25-0.175.3.36.0.19.0 on Solaris 11.3Upgrade web/php-73 to version 7.3.11-11.4.16.0.1.3.0 on Solaris 11.4 | Dec 18, 2019 | Oct 21, 2019 |
| Oracle_linux | — | Upgrade python3-magicUpgrade file-develUpgrade fileUpgrade file-libs | Nov 17, 2021 | Aug 26, 2019 |
| Redhat_linux | — | Upgrade file-libs-debuginfoUpgrade file-debuginfoUpgrade file-debugsourceUpgrade file-develUpgrade fileUpgrade file-libsUpgrade python3-magic | Nov 10, 2021 | Oct 21, 2019 |
| Rocky_linux | — | Upgrade file-libsUpgrade file-debugsourceUpgrade fileUpgrade file-debuginfoUpgrade file-libs-debuginfoUpgrade file-devel | Mar 12, 2024 | Oct 21, 2019 |
| Suse | — | Upgrade libmagic1-32bitUpgrade file-develUpgrade file-devel-32bitUpgrade fileUpgrade file-magicUpgrade python2-magicUpgrade python3-magicUpgrade libmagic1Upgrade python-magic | May 23, 2020 | Oct 21, 2019 |
| Ubuntu | — | Upgrade fileUpgrade libmagic1 (Ubuntu Pro)Upgrade libmagic1Upgrade file (Ubuntu Pro) | Oct 31, 2019 | Oct 21, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub