Lucene search

K
mageiaGentoo FoundationMGASA-2015-0030
HistoryJan 19, 2015 - 7:47 p.m.

Updated file packages fix security vulnerabilities

2015-01-1919:47:36
Gentoo Foundation
advisories.mageia.org
8

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.061 Low

EPSS

Percentile

93.4%

Updated file packages fix security vulnerabilities: Alexander Cherepanov reported that using the file command on a specially-crafted ELF binary could lead to a denial of service due to uncontrolled resource consumption while processing ELF section headers (CVE-2014-9620, CVE-2014-9621). As part of the fixes, several limits on aspects of the detection were added or tightened, sometimes resulting in messages like “recursion limit exceeded” or “too many program header sections”. To mitigate such shortcomings, these limits are controllable by a new -P, --parameter option in the file program.

OSVersionArchitecturePackageVersionFilename
Mageia4noarchfile< 5.16-1.10file-5.16-1.10.mga4

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.061 Low

EPSS

Percentile

93.4%