diff options
| author | Raphael Kubo da Costa <rakuco@FreeBSD.org> | 2019-11-02 12:19:33 +0000 |
|---|---|---|
| committer | Raphael Kubo da Costa <rakuco@FreeBSD.org> | 2019-11-02 12:19:33 +0000 |
| commit | 0657fb4b72b53de7580363482ac4a8973895558d (patch) | |
| tree | ab41e7a0ba8f82ffcf9953fbc48586bb4dff1030 | |
| parent | security/py-pycryptodome: Update to 3.9.0 (diff) | |
Add entry for heap buffer overflow in sysutils/file.
PR: 241424
Submitted by: Nathan Owens <ndowens04@gmail.com>
Approved by: jharris@widomaker.com (maintainer)
| -rw-r--r-- | security/vuxml/vuln.xml | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 4ac7f67b5132..bb1b6e67e841 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,35 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="381deebb-f5c9-11e9-9c4f-74d435e60b7c"> + <topic>file -- Heap buffer overflow possible</topic> + <affects> + <package> + <name>file</name> + <range><lt>5.37</lt></range> + <range><eq>5.37</eq></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>mitre reports</p> + <blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18218"> + <p>cdf_read_property_info in cdf.c in file through 5.37 does not + restrict the number of CDF_VECTOR elements, which allows a heap-based + buffer overflow (4-byte out-of-bounds write).</p> + </blockquote> + </body> + </description> + <references> + <url>https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780</url> + <url>https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84</url> + </references> + <dates> + <discovery>2019-08-26</discovery> + <entry>2019-11-02</entry> + </dates> + </vuln> + <vuln vid="92243b6a-5775-4aea-8727-a938058df5ba"> <topic>webkit2-gtk3 -- Multiple vulnerabilities</topic> <affects> |