| Summary: | file new security issue CVE-2012-1571 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, derekjenn, sysadmin-bugs, tmb |
| Version: | 1 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Source RPM: | file-5.06-1.mga1.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2012-03-23 14:25:12 CET
Looks like the fix is to just update to the CDF code from file 5.11. Uploaded. Advisory: ======================== Updated file packages fix security vulnerabilities: Multiple out-of heap-based buffer read flaws and invalid pointer dereference flaws were found in the way file, utility for determining of file types processed header section for certain Composite Document Format (CDF) files. A remote attacker could provide a specially-crafted CDF file, which once inspected by the file utility of the victim would lead to file executable crash (CVE-2012-1571). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1571 https://bugzilla.redhat.com/show_bug.cgi?id=805197 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:035 ======================== Updated packages in core/updates_testing: ======================== file-5.06-1.1.mga1 libmagic1-5.06-1.1.mga1 libmagic-devel-5.06-1.1.mga1 libmagic-static-devel-5.06-1.1.mga1 python-magic-5.06-1.1.mga1 from file-5.06-1.1.mga1.src.rpm Assignee:
bugsquad =>
qa-bugs Testing complete on i586 for the srpm file-5.06-1.1.mga1.src.rpm Just testing that it works with "file *". CC:
(none) =>
davidwhodgins Testing complete on x86_64 Downloaded example .cdf file confirmed same response from file command both before and after update. Update Validated Could sysadmin please push file-5.06-1.1.mga1.src.rpm from core/updates_testing to core/updates Advisory: ======================== Updated file packages fix security vulnerabilities: Multiple out-of heap-based buffer read flaws and invalid pointer dereference flaws were found in the way file, utility for determining of file types processed header section for certain Composite Document Format (CDF) files. A remote attacker could provide a specially-crafted CDF file, which once inspected by the file utility of the victim would lead to file executable crash (CVE-2012-1571). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1571 https://bugzilla.redhat.com/show_bug.cgi?id=805197 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:035 ======================== Keywords:
(none) =>
validated_update Update pushewd Status:
NEW =>
RESOLVED |