[ GLSA 202003-24 ] file

[GLSA]

Gentoo Linux Security Advisory

Title: file: Heap-based buffer overflow (GLSA 202003-24)
Severity: normal
Exploitable: local, remote
Date: 2020-03-15
Bug(s): #698610
ID: 202003-24

Synopsis

A heap-based buffer overflow in file might allow remote attackers
to execute arbitrary code.


Background

file is a utility that guesses a file format by scanning binary data for
patterns.


Affected Packages

Package: sys-apps/file
Vulnerable: < 5.37-r1
Unaffected: >= 5.37-r1
Architectures: All supported architectures


Description

It was discovered that file incorrectly handled certain malformed files.

Impact

A remote attacker could entice a user to process a specially crafted
file via libmagic or file, possibly resulting in execution of arbitrary
code with the privileges of the process or a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All file users should upgrade to the latest version: