Bug 1590000 (CVE-2018-10360)

Summary:	CVE-2018-10360 file: out-of-bounds read via a crafted ELF file
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	harald, hhorak, jkaluza, jorton, kdudka, kvolny, macermak, packaging-team-maint, rcollet, webstack-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-31 22:32:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1590001, 1590002, 1591949, 1591950, 1591951, 1591952, 1837049, 1837050, 1837051
Bug Blocks:	1590004, 1679141

Description Laura Pardo 2018-06-11 19:46:17 UTC

A flaw was found in file. The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.


References:
https://github.com/file/file/commit/a642587a9c9e2dd7feacdf513c3643ce26ad3c22

Comment 1 Laura Pardo 2018-06-11 19:46:45 UTC

Created file tracking bugs for this issue:

Affects: fedora-all [bug 1590002]

Comment 4 Karel Volný 2020-01-28 15:36:55 UTC

do we have a reproducer for this?

Comment 5 Laura Pardo 2020-02-07 13:54:48 UTC

(In reply to Karel Volný from comment #4)
> do we have a reproducer for this?

Not as far as I'm aware of. It wasn't in the report.

Comment 6 Karel Volný 2020-02-10 08:17:45 UTC

(In reply to Laura Pardo from comment #5)
> (In reply to Karel Volný from comment #4)
> > do we have a reproducer for this?
> 
> Not as far as I'm aware of. It wasn't in the report.

thanks, marking the dependent bug SanityOnly then

Comment 7 errata-xmlrpc 2020-03-31 19:12:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:1022 https://access.redhat.com/errata/RHSA-2020:1022

Comment 8 Product Security DevOps Team 2020-03-31 22:32:32 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-10360

Comment 11 errata-xmlrpc 2020-06-11 02:10:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Extended Update Support

Via RHSA-2020:2521 https://access.redhat.com/errata/RHSA-2020:2521

Comment 12 errata-xmlrpc 2020-06-30 12:08:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2020:2768 https://access.redhat.com/errata/RHSA-2020:2768

Comment 13 errata-xmlrpc 2020-07-07 10:16:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Extended Update Support

Via RHSA-2020:2838 https://access.redhat.com/errata/RHSA-2020:2838