CVE-2012-1571 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Zoulas File

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-125 — Out-of-bounds ReadCWE-122 — Heap-based Buffer OverflowCWE-190 — Integer Overflow or Wraparound17 documents9 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 37.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
File Project FileChristos Zoulas File
Timeline
PublishedJul 17
Latest updateMay 17

Description

file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶Debianfile_project/file< 5.11-1+3

Patches

Patch: mx.gw.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-xv4r-r9fj-hh6h: file before 5↗2022-05-17
▶
GHSA
GHSA-5mp5-8xxq-j3vx: Integer overflow in the cdf_read_property_info function in cdf↗2022-05-14
▶
CVEList
CVE-2014-3587: Integer overflow in the cdf_read_property_info function in cdf↗2014-08-23
▶
OSV
CVE-2012-1571: file before 5↗2012-07-17
▶
CVEList
CVE-2012-1571: file before 5↗2012-07-17
▶

📋Vendor Advisories

5
Red Hat
file: incomplete fix for CVE-2012-1571 in cdf_read_property_info↗2014-08-21
▶
BSD
FreeBSD-SA-14:16.file: Multiple vulnerabilities in file(1) and libmagic(3)↗2014-06-24
▶
Ubuntu
file vulnerabilities↗2014-02-26
▶
Red Hat
file: out of bounds read in CDF parser↗2012-02-16
▶
Debian
CVE-2012-1571: file - file before 5.11 and libmagic allow remote attackers to cause a denial of servic...↗2012
▶

💬Community

6
Bugzilla
CVE-2014-3587 php: file: incomplete fix for CVE-2012-1571 in cdf_read_property_info [fedora-all]↗2014-08-22
▶
Bugzilla
CVE-2014-3587 file: incomplete fix for CVE-2012-1571 in cdf_read_property_info [fedora-all]↗2014-08-22
▶
Bugzilla
CVE-2014-3587 file: incomplete fix for CVE-2012-1571 in cdf_read_property_info↗2014-08-11
▶
Bugzilla
CVE-2012-1571 file: out of bounds read in CDF parser [fedora-all]↗2014-06-30
▶
Bugzilla
CVE-2014-0207 file: cdf_read_short_sector insufficient boundary check↗2014-04-28
▶
CVE-2012-1571 — Christos Zoulas File vulnerability | cvebase