Medium: file

2019-12-1321:12:00

alas.aws.amazon.com

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

45.6%

JSON

Issue Overview:

cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write). (CVE-2019-18218)

Affected Packages:

file

Issue Correction:
Run yum update file to update your system.

New Packages:

i686:  
    file-debuginfo-5.37-8.48.amzn1.i686  
    file-devel-5.37-8.48.amzn1.i686  
    file-libs-5.37-8.48.amzn1.i686  
    file-5.37-8.48.amzn1.i686  
    file-static-5.37-8.48.amzn1.i686  
  
noarch:  
    python27-magic-5.37-8.48.amzn1.noarch  
    python26-magic-5.37-8.48.amzn1.noarch  
  
src:  
    file-5.37-8.48.amzn1.src  
  
x86_64:  
    file-libs-5.37-8.48.amzn1.x86_64  
    file-static-5.37-8.48.amzn1.x86_64  
    file-debuginfo-5.37-8.48.amzn1.x86_64  
    file-5.37-8.48.amzn1.x86_64  
    file-devel-5.37-8.48.amzn1.x86_64

Additional References

Red Hat: CVE-2019-18218

Mitre: CVE-2019-18218

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686file-debuginfo< 5.37-8.48.amzn1file-debuginfo-5.37-8.48.amzn1.i686.rpm
Amazon Linux1i686file-devel< 5.37-8.48.amzn1file-devel-5.37-8.48.amzn1.i686.rpm
Amazon Linux1i686file-libs< 5.37-8.48.amzn1file-libs-5.37-8.48.amzn1.i686.rpm
Amazon Linux1i686file< 5.37-8.48.amzn1file-5.37-8.48.amzn1.i686.rpm
Amazon Linux1i686file-static< 5.37-8.48.amzn1file-static-5.37-8.48.amzn1.i686.rpm
Amazon Linux1noarchpython27-magic< 5.37-8.48.amzn1python27-magic-5.37-8.48.amzn1.noarch.rpm
Amazon Linux1noarchpython26-magic< 5.37-8.48.amzn1python26-magic-5.37-8.48.amzn1.noarch.rpm
Amazon Linux1x86_64file-libs< 5.37-8.48.amzn1file-libs-5.37-8.48.amzn1.x86_64.rpm
Amazon Linux1x86_64file-static< 5.37-8.48.amzn1file-static-5.37-8.48.amzn1.x86_64.rpm
Amazon Linux1x86_64file-debuginfo< 5.37-8.48.amzn1file-debuginfo-5.37-8.48.amzn1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	file-debuginfo	< 5.37-8.48.amzn1	file-debuginfo-5.37-8.48.amzn1.i686.rpm
Amazon Linux	1	i686	file-devel	< 5.37-8.48.amzn1	file-devel-5.37-8.48.amzn1.i686.rpm
Amazon Linux	1	i686	file-libs	< 5.37-8.48.amzn1	file-libs-5.37-8.48.amzn1.i686.rpm
Amazon Linux	1	i686	file	< 5.37-8.48.amzn1	file-5.37-8.48.amzn1.i686.rpm
Amazon Linux	1	i686	file-static	< 5.37-8.48.amzn1	file-static-5.37-8.48.amzn1.i686.rpm
Amazon Linux	1	noarch	python27-magic	< 5.37-8.48.amzn1	python27-magic-5.37-8.48.amzn1.noarch.rpm
Amazon Linux	1	noarch	python26-magic	< 5.37-8.48.amzn1	python26-magic-5.37-8.48.amzn1.noarch.rpm
Amazon Linux	1	x86_64	file-libs	< 5.37-8.48.amzn1	file-libs-5.37-8.48.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	file-static	< 5.37-8.48.amzn1	file-static-5.37-8.48.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	file-debuginfo	< 5.37-8.48.amzn1	file-debuginfo-5.37-8.48.amzn1.x86_64.rpm