DSA-3121-1: file - security update
Summary
DSA-3121-1: file - security update. Affects file versions < 5.11-2+deb7u7. Fixed in 5.11-2+deb7u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'file' package is a tool/library used to determine the type of a file. It analyzes the contents of a file and provides information about its format and characteristics. This vulnerability affects the Debian 7 (wheezy) ecosystem.
Vulnerability Detail
Multiple security issues have been discovered in the 'file' package. Processing a malformed file could lead to a denial of service. The vulnerabilities primarily involve parsing ELF files. The fixes include adding or tightening limits on certain aspects of file detection, which may result in messages like 'recursion limit exceeded' or 'too many program header sections'. To address these shortcomings, the new '-P, --parameter' option in the file program allows control over these limits.
How To Fix
Minimum fixed version
5.11-2+deb7u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade fileTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The 'file' package has been found to have multiple security vulnerabilities that could lead to denial of service. It is crucial to upgrade to the latest version (5.11-2+deb7u7) to mitigate these issues. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for file →
FAQ
The vulnerabilities in the 'file' package could potentially be exploited to cause a denial of service by processing a specially crafted file.
The vulnerabilities affect versions prior to 5.11-2+deb7u7 for the Debian 7 (wheezy) ecosystem.
No specific workarounds have been provided for these vulnerabilities. It is recommended to apply the available security update.
To upgrade the 'file' package, you can use the package manager for your Debian-based system. For example, you can run 'apt-get update' followed by 'apt-get upgrade file' to install the latest version.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-3121-1.
Related vulnerabilities
Recent vulnerabilities recorded for file.
