Lucene search

K
mageiaGentoo FoundationMGASA-2014-0252
HistoryJun 06, 2014 - 9:52 a.m.

Updated file packages fix CVE-2014-0237-8

2014-06-0609:52:39
Gentoo Foundation
advisories.mageia.org
10

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.098 Low

EPSS

Percentile

94.7%

Updated file packages fix security vulnerabilities: A flaw was found in the way file’s Composite Document Files (CDF) format parser handle CDF files with many summary info entries. The cdf_unpack_summary_info() function unnecessarily repeatedly read the info from the same offset. This led to many file_printf() calls in cdf_file_property_info(), which caused file to use an excessive amount of CPU time when parsing a specially-crafted CDF file (CVE-2014-0237). A flaw was found in the way file parsed property information from Composite Document Files (CDF) files. A property entry with 0 elements triggers an infinite loop (CVE-2014-0238).

OSVersionArchitecturePackageVersionFilename
Mageia3noarchfile< 5.12-8.4file-5.12-8.4.mga3
Mageia4noarchfile< 5.16-1.3file-5.16-1.3.mga4

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.098 Low

EPSS

Percentile

94.7%