Advisories » MGASA-2015-0030

Updated file packages fix security vulnerabilities

Publication date: 19 Jan 2015
Modification date: 19 Jan 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-9620 , CVE-2014-9621

Description

Updated file packages fix security vulnerabilities:

Alexander Cherepanov reported that using the file command on a
specially-crafted ELF binary could lead to a denial of service due to
uncontrolled resource consumption while processing ELF section headers
(CVE-2014-9620, CVE-2014-9621).

As part of the fixes, several limits on aspects of the detection were added
or tightened, sometimes resulting in messages like "recursion limit exceeded"
or "too many program header sections".

To mitigate such shortcomings, these limits are controllable by a new -P,
--parameter option in the file program.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=15064
• http://openwall.com/lists/oss-security/2015/01/17/9
• https://www.debian.org/security/2015/dsa-3121
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9620
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9621

SRPMS

4/core

• file-5.16-1.10.mga4