Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-1536 — Integer Overflow or Wraparound in File

CWE-189CWE-190 — Integer Overflow or Wraparound15 documents10 sources
Severity
9.3CRITICALNVD
EPSS
41.9%
top 2.56%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
File Project FileFile
Timeline
PublishedMar 20
Latest updateMay 3

Description

Integer underflow in the file_printf function in the "file" program before 4.20 allows user-assisted attackers to execute arbitrary code via a file that triggers a heap-based buffer overflow.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶Debianfile_project/file< 4.20-1+3
▶NVDfile/file4.19

Patches

Patch: mx.gw.com ↗Patch: secunia.com ↗Patch: mx.gw.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-g967-rw3c-p2f7: Integer overflow in the "file" program 4↗2022-05-03
▶
GHSA
GHSA-h28w-vfj4-vh5j: Integer underflow in the file_printf function in the "file" program before 4↗2022-05-03
▶
CVEList
CVE-2007-2799: Integer overflow in the "file" program 4↗2007-05-23
▶
OSV
CVE-2007-1536: Integer underflow in the file_printf function in the "file" program before 4↗2007-03-20
▶
CVEList
CVE-2007-1536: Integer underflow in the file_printf function in the "file" program before 4↗2007-03-20
▶

💥Exploits & PoCs

1
Exploit-DB
File(1) 4.13 - Command File_PrintF Integer Underflow↗2007-03-19
▶

📋Vendor Advisories

5
BSD
FreeBSD-SA-07:04.file: Heap overflow in file(1)↗2007-05-23
▶
Red Hat
file integer overflow↗2007-05-23
▶
Ubuntu
file vulnerability↗2007-03-22
▶
Red Hat
file 4.20 fixes a heap overflow in that can result in arbitrary code execution↗2007-02-08
▶
Debian
CVE-2007-1536: file - Integer underflow in the file_printf function in the "file" program before 4.20 ...↗2007
▶

💬Community

3
Bugzilla
CVE-2007-1536 file 4.20 fixes a heap overflow in that can result in arbitrary code execution↗2007-03-21
▶
Bugzilla
CVE-2007-1536 file 4.20 fixes a heap overflow in that can result in arbitrary code execution↗2007-03-20
▶
Bugzilla
CVE-2007-1536 file 4.20 fixes a heap overflow in that can result in arbitrary code execution↗2007-03-20
▶
CVE-2007-1536 — Integer Overflow or Wraparound in File | cvebase