File

CVEs (36)

• CVE-2019-8907HigFeb 18, 2019
  File Project

  File
  risk 0.57cvss 8.8epss 0.03

  do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact.

• CVE-2019-8904HigFeb 18, 2019
  File Project

  File
  risk 0.57cvss 8.8epss 0.02

  do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf and file_vprintf.

• CVE-2014-0236HigMay 16, 2016
  PHP

  PHP
  risk 0.49cvss 7.5epss 0.03

  file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.

• CVE-2019-18218HigOct 21, 2019
  File Project

  File
  risk 0.44cvss 7.8epss 0.02

  cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).

• CVE-2015-8865HigMay 20, 2016
  PHP

  PHP
  risk 0.41cvss 7.3epss 0.05

  The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer…

• CVE-2014-0207MedJul 9, 2014
  PHP

  PHP
  risk 0.37cvss 6.5epss 0.17

  The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

• CVE-2022-48554MedAug 22, 2023
  Open Source

  File
  risk 0.36cvss 5.5epss 0.01

  File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.

• CVE-2017-1000249MedSep 11, 2017
  File Project

  File
  risk 0.36cvss 5.5epss 0.00

  An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793…

• CVE-2014-3480MedJul 9, 2014
  PHP

  PHP
  risk 0.36cvss 6.5epss 0.11

  The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted…

• CVE-2014-3478MedJul 9, 2014
  PHP

  PHP
  risk 0.36cvss 6.5epss 0.15

  Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING…

• CVE-2012-1571MedJul 17, 2012
  Tim Robbins

  Libmagic
  risk 0.36cvss 6.5epss 0.04

  file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference.

• CVE-2019-8905MedFeb 18, 2019
  File Project

  File
  risk 0.29cvss 4.4epss 0.00

  do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360.

• CVE-2007-1536Mar 20, 2007
  File Project

  File
  risk 0.04cvss —epss 0.12

  Integer underflow in the file_printf function in the "file" program before 4.20 allows user-assisted attackers to execute arbitrary code via a file that triggers a heap-based buffer overflow.

• CVE-2004-1304Jan 10, 2005
  File Project

  File
  risk 0.04cvss —epss 0.11

  Stack-based buffer overflow in the ELF header parsing code in file before 4.12 allows attackers to execute arbitrary code via a crafted ELF file.

• CVE-2003-1092Dec 31, 2003
  File Project

  File
  risk 0.03cvss —epss 0.04

  Unknown vulnerability in the "Automatic File Content Type Recognition (AFCTR) Tool version of the file package before 3.41, related to "a memory allocation problem," has unknown impact.

• CVE-2003-0102Mar 18, 2003
  File Project

  File
  risk 0.03cvss —epss 0.02

  Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize).

• CVE-2019-8906MedFeb 18, 2019
  File Project

  File
  risk 0.00cvss 4.4epss 0.00

  do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.

• CVE-2018-10360MedJun 11, 2018
  File Project

  File
  risk 0.00cvss 6.5epss 0.03

  The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.

• CVE-2014-9653Mar 30, 2015
  PHP

  PHP
  risk 0.00cvss —epss 0.05

  readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service…

• CVE-2014-9652Mar 30, 2015
  PHP

  PHP
  risk 0.00cvss —epss 0.05

  The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which…