Stack-based Buffer Over-read in libmagic.a in file 5.35
Summary
CVE-2019-8905: do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360. Affects file across 2 version ranges.
< 5.36-r0
< d1ff3af7a2c6b38bdbdde7af26b59e3c50a48fff
Fixed in 5.36-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'file' package is a utility that determines the type of a file by examining its contents. It is commonly used to identify the file type of unknown files. The package includes the libmagic library, which provides the functionality for file type identification. However, a vulnerability has been discovered in version 5.35 of the 'file' package that can lead to a stack-based buffer over-read.
Vulnerability Detail
The vulnerability, identified as CVE-2019-8905, exists in the 'do_core_note' function in the 'readelf.c' file of the 'libmagic.a' library. It is caused by a stack-based buffer over-read related to 'file_printable'. This vulnerability is different from CVE-2018-10360. An attacker could exploit this vulnerability to read beyond the bounds of a stack buffer, potentially leading to information disclosure or a denial of service.
How To Fix
Minimum fixed version
5.36-r0
This is the first release that contains the fix.
sudo apk add --upgrade fileTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided in the updated version of the 'file' package.
Conclusion
In conclusion, the 'file' package version 5.35 is vulnerable to a stack-based buffer over-read. To mitigate this vulnerability, it is recommended to update to version 5.36-r0 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for file →
FAQ
This vulnerability could potentially allow an attacker to read beyond the bounds of a stack buffer, leading to information disclosure or a denial of service.
There is no known exploit for this vulnerability at the moment.
No, only versions up to and including 5.35 are affected. Versions 5.36-r0 and later include the necessary fix.
No, a system restart is not required. The fix can be applied by updating the 'file' package.
You can find more information about this vulnerability in the CVE-2019-8905 JSON report available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-8905.json
References
Related vulnerabilities
Recent vulnerabilities recorded for file.
