MGASA-2014-0282

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2014-0282.html
Import Source
https://advisories.mageia.org/MGASA-2014-0282.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2014-0282
Related
Published
2014-07-04T18:26:27Z
Modified
2014-07-04T18:26:19Z
Summary
Updated file packages fix security vulnerabilities
Details

A flaw was found in the way file parsed property information from Composite Document Files (CDF) files, where the mconvert() function did not correctly compute the truncated pascal string size (CVE-2014-3478).

Multiple flaws were found in the way file parsed property information from Composite Document Files (CDF) files, due to insufficient boundary checks on buffers (CVE-2014-3479, CVE-2014-3480, CVE-2014-3487).

Note: these issues were announced as part of the upstream PHP 5.4.30 release, as PHP bundles file's libmagic library. Their announcement also references an issue in CDF file parsing, CVE-2014-0207, which was previously fixed in the file package in MGASA-2014-0252, but was not announced at that time.

References
Credits

Affected packages

Mageia:3 / file

Package

Name
file
Purl
pkg:rpm/mageia/file?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.12-8.5.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:4 / file

Package

Name
file
Purl
pkg:rpm/mageia/file?distro=mageia-4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.16-1.4.mga4

Ecosystem specific 

{
    "section": "core"
}