Mandriva has issued this advisory today (March 23): http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:035 Cauldron is not vulnerable.
Looks like the fix is to just update to the CDF code from file 5.11. Uploaded. Advisory: ======================== Updated file packages fix security vulnerabilities: Multiple out-of heap-based buffer read flaws and invalid pointer dereference flaws were found in the way file, utility for determining of file types processed header section for certain Composite Document Format (CDF) files. A remote attacker could provide a specially-crafted CDF file, which once inspected by the file utility of the victim would lead to file executable crash (CVE-2012-1571). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1571 https://bugzilla.redhat.com/show_bug.cgi?id=805197 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:035 ======================== Updated packages in core/updates_testing: ======================== file-5.06-1.1.mga1 libmagic1-5.06-1.1.mga1 libmagic-devel-5.06-1.1.mga1 libmagic-static-devel-5.06-1.1.mga1 python-magic-5.06-1.1.mga1 from file-5.06-1.1.mga1.src.rpm
Assignee: bugsquad => qa-bugs
Testing complete on i586 for the srpm file-5.06-1.1.mga1.src.rpm Just testing that it works with "file *".
CC: (none) => davidwhodgins
Testing complete on x86_64 Downloaded example .cdf file confirmed same response from file command both before and after update. Update Validated Could sysadmin please push file-5.06-1.1.mga1.src.rpm from core/updates_testing to core/updates Advisory: ======================== Updated file packages fix security vulnerabilities: Multiple out-of heap-based buffer read flaws and invalid pointer dereference flaws were found in the way file, utility for determining of file types processed header section for certain Composite Document Format (CDF) files. A remote attacker could provide a specially-crafted CDF file, which once inspected by the file utility of the victim would lead to file executable crash (CVE-2012-1571). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1571 https://bugzilla.redhat.com/show_bug.cgi?id=805197 http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2012:035 ========================
Keywords: (none) => validated_updateCC: (none) => derekjenn, sysadmin-bugs
Update pushewd
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED