A flaw was found in file. The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file. References: https://github.com/file/file/commit/a642587a9c9e2dd7feacdf513c3643ce26ad3c22
Created file tracking bugs for this issue: Affects: fedora-all [bug 1590002]
do we have a reproducer for this?
(In reply to Karel Volný from comment #4) > do we have a reproducer for this? Not as far as I'm aware of. It wasn't in the report.
(In reply to Laura Pardo from comment #5) > (In reply to Karel Volný from comment #4) > > do we have a reproducer for this? > > Not as far as I'm aware of. It wasn't in the report. thanks, marking the dependent bug SanityOnly then
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:1022 https://access.redhat.com/errata/RHSA-2020:1022
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2018-10360
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Extended Update Support Via RHSA-2020:2521 https://access.redhat.com/errata/RHSA-2020:2521
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions Red Hat Enterprise Linux 7.4 Telco Extended Update Support Via RHSA-2020:2768 https://access.redhat.com/errata/RHSA-2020:2768
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Extended Update Support Via RHSA-2020:2838 https://access.redhat.com/errata/RHSA-2020:2838