CVE-2019-8906 — Out-of-bounds Read in Project File

CWE-125 — Out-of-bounds Read14 documents10 sources
Severity
4.4MEDIUMNVD
EPSS
0.1%
top 77.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
File Project FileApple Iphone OSApple MAC OS X+4 more
Timeline
PublishedFeb 18
Latest updateMay 13

Description

do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:LExploitability: 1.8 | Impact: 2.5

Affected Packages7 packages

▶Debianfile_project/file< 1:5.35-3+3
▶NVDapple/tvos< 12.2
▶NVDapple/watchos< 5.2
▶NVDapple/mac_os_x< 10.14.4

Also affects: Ubuntu Linux 16.04, 18.04, 18.10

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-gc52-2h3f-7mvf: do_core_note in readelf↗2022-05-13
▶
CVEList
CVE-2019-8906: do_core_note in readelf↗2019-02-18
▶
OSV
CVE-2019-8906: do_core_note in readelf↗2019-02-18
▶

💥Exploits & PoCs

1
Exploit-DB
Adobe Acrobat Reader DC for Windows - Heap-Based Buffer Overflow in CoolType.dll↗2019-08-15
▶

📋Vendor Advisories

7
Apple
CVE-2019-8906: watchOS 5.2↗2019-03-27
▶
Apple
CVE-2019-8906: iOS 12.2↗2019-03-25
▶
Apple
CVE-2019-8906: tvOS 12.2↗2019-03-25
▶
Apple
CVE-2019-8906: macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra↗2019-03-25
▶
Ubuntu
file vulnerabilities↗2019-03-18
▶

💬Community

2
Bugzilla
CVE-2019-8906 file: out-of-bounds read in do_core_note in readelf.c↗2019-02-20
▶
Bugzilla
CVE-2019-8906 file: out-of-bounds read in do_core_note in readelf.c [fedora-all]↗2019-02-20
▶
CVE-2019-8906 — Out-of-bounds Read in File Project File | cvebase