cdfreadpropertyinfo in cdf.c in file through 5.37 does not restrict the number of CDFVECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "file": "1:5.14-2ubuntu3.4+esm1", "python-magic": "1:5.14-2ubuntu3.4+esm1", "python3-magic": "1:5.14-2ubuntu3.4+esm1", "libmagic1": "1:5.14-2ubuntu3.4+esm1", "file-dbg": "1:5.14-2ubuntu3.4+esm1", "libmagic-dev-dbgsym": "1:5.14-2ubuntu3.4+esm1", "libmagic-dev": "1:5.14-2ubuntu3.4+esm1", "libmagic1-dbgsym": "1:5.14-2ubuntu3.4+esm1", "file-dbgsym": "1:5.14-2ubuntu3.4+esm1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "file": "1:5.25-2ubuntu1.3", "python-magic": "1:5.25-2ubuntu1.3", "python3-magic": "1:5.25-2ubuntu1.3", "libmagic1": "1:5.25-2ubuntu1.3", "file-dbg": "1:5.25-2ubuntu1.3", "libmagic-dev-dbgsym": "1:5.25-2ubuntu1.3", "libmagic-dev": "1:5.25-2ubuntu1.3", "libmagic1-dbgsym": "1:5.25-2ubuntu1.3", "file-dbgsym": "1:5.25-2ubuntu1.3" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "file-dbgsym": "1:5.32-2ubuntu0.3", "libmagic1-dbgsym": "1:5.32-2ubuntu0.3", "file": "1:5.32-2ubuntu0.3", "libmagic-dev": "1:5.32-2ubuntu0.3", "libmagic1": "1:5.32-2ubuntu0.3", "libmagic-mgc": "1:5.32-2ubuntu0.3" } ] }