Heap-based Buffer Overflow in file Package (CVE-2019-18218)
Summary
CVE-2019-18218: cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write). Affects file across 2 version ranges.
< 5.37-r1
< 46a8443f76cec4b41ec736eca396984c74664f84
Fixed in 5.37-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The file package is a widely used tool for determining the type of data contained within a file. It provides functionality to identify file formats based on their content and metadata. The package is commonly used in various operating systems and software applications.
Vulnerability Detail
The vulnerability, identified as CVE-2019-18218, exists in the cdf_read_property_info function within the file package. This function does not impose restrictions on the number of CDF_VECTOR elements, leading to a heap-based buffer overflow. An attacker could exploit this vulnerability to trigger a 4-byte out-of-bounds write, potentially resulting in arbitrary code execution or denial of service.
How To Fix
Minimum fixed version
5.37-r1
This is the first release that contains the fix.
sudo apk add --upgrade fileTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is advised to apply the recommended fix by updating the file package to the patched version.
Conclusion
The heap-based buffer overflow vulnerability in the file package (CVE-2019-18218) poses a risk of arbitrary code execution or denial of service. It is crucial to update the package to version 5.37-r1 or later to mitigate this vulnerability. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for file →
FAQ
The vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by exploiting the heap-based buffer overflow.
The vulnerability affects file package versions prior to 5.37-r1.
There are no known instances of this vulnerability being exploited in the wild.
Yes, the CVSS score for this vulnerability is 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
You can find more information about this vulnerability in the CVE-2019-18218 JSON report available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-18218.json
Related vulnerabilities
Recent vulnerabilities recorded for file.
