The PHP 5.6.20 update (Bug 18101) fixes an issue in the PHP fileinfo module, which came from a bug in file itself, which was fixed here: https://github.com/file/file/commit/6713ca45e7757297381f4b4cdb9cf5e624a9ad36 I've added that patch to our Mageia 5 file package. Advisory: ======================== Updated file packages fix security vulnerability: The file command was vulnerable to a buffer over-write in with a malformed magic file. References: http://git.php.net/?p=php-src.git;a=commit;h=5272184a1ed0c5c6144e80bed6fb1951601ec3bc ======================== Updated packages in core/updates_testing: ======================== file-5.19-10.1.mga5 libmagic1-5.19-10.1.mga5 libmagic-devel-5.19-10.1.mga5 libmagic-static-devel-5.19-10.1.mga5 python-magic-5.19-10.1.mga5 from file-5.19-10.1.mga5.src.rpm
CC: (none) => davidwhodginsWhiteboard: (none) => advisory
Not too sure how to fully test the memory leak however basic usage of file is still working. Tested on: Mageia release 5 (Official) for x86_64 Package(s) Under Test: file-5.19-10.mga5.x86_64 Package(s) Testing Pre Upgrade: %urpmi file Package file-5.19-10.mga5.x86_64 is already installed %file -s /dev/vda{1,2,3,4,5} /dev/vda1: Linux rev 1.0 ext4 filesystem data, UUID=c37071fe-a421-42eb-8f2a-6c3900e4405b (needs journal recovery) (extents) (large files) (huge files) /dev/vda2: DOS/MBR boot sector /dev/vda3: cannot open `/dev/vda3' (No such file or directory) /dev/vda4: cannot open `/dev/vda4' (No such file or directory) /dev/vda5: Linux/i386 swap file (new style), ver %file -s /usr/bin/urpm* /usr/bin/urpmf: Perl script, ASCII text executable /usr/bin/urpmi_rpm-find-leaves: symbolic link to `rpm-find-leaves' /usr/bin/urpmi.update: POSIX shell script, ASCII text executable /usr/bin/urpmq: Perl script, ASCII text executable Package(s) Testing Upgrade: %urpmi file Package file-5.19-10.1.mga5.x86_64 is already installed %file -s /dev/vda{1,2,3,4,5} /dev/vda1: Linux rev 1.0 ext4 filesystem data, UUID=c37071fe-a421-42eb-8f2a-6c3900e4405b (needs journal recovery) (extents) (large files) (huge files) /dev/vda2: DOS/MBR boot sector /dev/vda3: cannot open `/dev/vda3' (No such file or directory) /dev/vda4: cannot open `/dev/vda4' (No such file or directory) /dev/vda5: Linux/i386 swap file (new style), version 1 (4K pages), size 606641 pages, no label, UUID=97bef969-2973-4d11-9bed-b929bf60a3c4 %file -s /usr/bin/urpm* /usr/bin/urpmf: Perl script, ASCII text executable /usr/bin/urpmi_rpm-find-leaves: symbolic link to `rpm-find-leaves' /usr/bin/urpmi.update: POSIX shell script, ASCII text executable /usr/bin/urpmq: Perl script, ASCII text executable Kernal Version: 4.1.15-desktop-2.mga5 x86_64 Hardware Information: product: Standard PC (i440FX + PIIX, 1996) vendor: QEMU
CC: (none) => dpremyWhiteboard: advisory => MGA5-64-OK advisory
Linux localhost 4.1.15-desktop-2.mga5 #1 SMP Wed Jan 20 17:05:51 UTC 2016 x86_64 x86_64 x86_64 GNU/Linu [root@localhost brian]# urpmi file Package file-5.19-10.1.mga5.x86_64 is already installed [brian@localhost ~]$ file journ_20160318_afternoon.txt journ_20160318_afternoon.txt: ASCII text, with very long lines Ran it file * as well. No issues I can identify. MGA5-64-OK
CC: (none) => brtians1Whiteboard: MGA5-64-OK advisory => MGA5-64-OK advisory MGA5-64-OK
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Keywords: validated_update => (none)
[brian@localhost ~]$ uname -a Linux localhost 4.1.15-desktop-2.mga5 #1 SMP Wed Jan 20 17:37:30 UTC 2016 i686 i686 i686 GNU/Linux [root@localhost brian]# urpmi file Package file-5.19-10.1.mga5.i586 is already installed [root@localhost brian]# [brian@localhost php]$ file * info.php: PHP script, UTF-8 Unicode (with BOM) text [brian@localhost php]$ MGA5-32-ok
Whiteboard: MGA5-64-OK advisory MGA5-64-OK => MGA5-64-OK advisory MGA5-32-OK
Keywords: (none) => validated_update
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0132.html
Status: NEW => RESOLVEDResolution: (none) => FIXED
URL: (none) => http://lwn.net/Vulnerabilities/682759/
CVE-2015-8865 has been assigned for this: http://openwall.com/lists/oss-security/2016/04/24/1
Summary: file new memory corruption security issue => file new memory corruption security issue (CVE-2015-8865)