Bug 1323118 (CVE-2015-8865) - CVE-2015-8865 file: Buffer over-write in finfo_open with malformed magic file
Summary: CVE-2015-8865 file: Buffer over-write in finfo_open with malformed magic file
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-8865
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1323712
Blocks: 1323121 1323711
TreeView+ depends on / blocked
 
Reported: 2016-04-01 10:20 UTC by Adam Mariš
Modified: 2021-02-17 04:06 UTC (History)
15 users (show)

Fixed In Version: file 5.23, php 5.5.34, php 5.6.20, php 7.0.5
Clone Of:
Environment:
Last Closed: 2016-05-30 10:48:05 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2750 0 normal SHIPPED_LIVE Moderate: rh-php56 security, bug fix, and enhancement update 2016-11-15 16:40:02 UTC

Description Adam Mariš 2016-04-01 10:20:53 UTC 
Buffer over-write vulnerability in finfo_open triggered by malformed magic file was found, causing segfault when running with environment variable USE_ZEND_ALLOC set to 0, and also when compiled with ASAN with USE_ZEND_ALLOC set and unset.

This issue was fixed in file-5.23.

Upstream bug (contains reproducer):

http://bugs.gw.com/view.php?id=522

PHP bug:

https://bugs.php.net/bug.php?id=71527

Upstream patch:

https://github.com/file/file/commit/6713ca45e7757297381f4b4cdb9cf5e624a9ad36
https://git.php.net/?p=php-src.git;a=commit;h=fe13566c93f118a15a96320a546c7878fd0cfc5e
Comment 2 Adam Mariš 2016-04-04 13:34:37 UTC 
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1323712]
Comment 3 Fedora Update System 2016-04-09 14:21:32 UTC 
php-5.6.20-1.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2016-04-09 14:22:59 UTC 
php-5.6.20-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 6 Stefan Cornelius 2016-05-10 08:43:12 UTC 
Mitigation:

Do not use untrusted magic files.
Comment 7 Tomas Hoger 2016-05-30 10:48:05 UTC 
Magic file is really a configuration file for file/libmagic.  The use of untrusted magic file is unlikely, the typical use of file is to identify types of (possibly untrusted) files using fully trusted magic files.  In any typical use case, this does not cross any trust boundary and hence the fix is not planned to be backported as security fix to already released Red Hat products.
Comment 8 errata-xmlrpc 2016-11-15 11:51:02 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS

Via RHSA-2016:2750 https://rhn.redhat.com/errata/RHSA-2016-2750.html
Note You need to log in before you can comment on or make changes to this bug.