CVE-2019-18218

cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Affected Products (NVD)
VendorProductVersion
file_projectfile
𝑥
≤ 5.37
debiandebian_linux
8.0
debiandebian_linux
9.0
debiandebian_linux
10.0
opensuseleap
15.1
netappactive_iq_unified_manager
7.3 ≤
canonicalubuntu_linux
12.04
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
19.04
canonicalubuntu_linux
19.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
file
bookworm
1:5.44-3
fixed
bullseye
1:5.39-3+deb11u1
fixed
bullseye (security)
1:5.39-3+deb11u1
fixed
sid
1:5.45-3
fixed
trixie
1:5.45-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
file
bionic
Fixed 1:5.32-2ubuntu0.3
released
disco
Fixed 1:5.35-4ubuntu0.1
released
eoan
Fixed 1:5.37-5ubuntu0.1
released
trusty
Fixed 1:5.14-2ubuntu3.4+esm1
released
xenial
Fixed 1:5.25-2ubuntu1.3
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
file
suse enterprise desktop 15 SP1
5.32-7.8.1
fixed
suse enterprise desktop 15 SP2
5.32-7.8.1
fixed
suse enterprise desktop 15 SP3
5.32-7.8.1
fixed
suse enterprise desktop 15 SP4
5.32-7.8.1
fixed
suse enterprise desktop 15 SP5
5.32-7.8.1
fixed
suse enterprise desktop 15 SP6
5.32-7.8.1
fixed
suse enterprise desktop 15 SP7
5.32-7.8.1
fixed
suse enterprise sap 12 SP3
5.22-10.21.1
fixed
suse enterprise sap 12 SP4
5.22-10.21.1
fixed
suse enterprise sap 12 SP5
5.22-10.21.1
fixed
suse enterprise sap 15 SP1
5.32-7.8.1
fixed
suse enterprise sap 15 SP2
5.32-7.8.1
fixed
suse enterprise sap 15 SP3
5.32-7.8.1
fixed
suse enterprise sap 15 SP4
5.32-7.8.1
fixed
suse enterprise sap 15 SP5
5.32-7.8.1
fixed
suse enterprise sap 15 SP6
5.32-7.8.1
fixed
suse enterprise sap 15 SP7
5.32-7.8.1
fixed
suse enterprise server 12 SP2
5.22-10.21.1
fixed
suse enterprise server 12 SP3
5.22-10.21.1
fixed
suse enterprise server 12 SP4
5.22-10.21.1
fixed
suse enterprise server 12 SP5
5.22-10.21.1
fixed
suse enterprise server 15 SP1
5.32-7.8.1
fixed
suse enterprise server 15 SP2
5.32-7.8.1
fixed
suse enterprise server 15 SP3
5.32-7.8.1
fixed
suse enterprise server 15 SP4
5.32-7.8.1
fixed
suse enterprise server 15 SP5
5.32-7.8.1
fixed
suse enterprise server 15 SP6
5.32-7.8.1
fixed
suse enterprise server 15 SP7
5.32-7.8.1
fixed
file-devel
suse enterprise desktop 15 SP1
5.32-7.8.1
fixed
suse enterprise desktop 15 SP2
5.32-7.8.1
fixed
suse enterprise desktop 15 SP3
5.32-7.8.1
fixed
suse enterprise desktop 15 SP4
5.32-7.8.1
fixed
suse enterprise desktop 15 SP5
5.32-7.8.1
fixed
suse enterprise desktop 15 SP6
5.32-7.8.1
fixed
suse enterprise desktop 15 SP7
5.32-7.8.1
fixed
suse enterprise sap 15 SP1
5.32-7.8.1
fixed
suse enterprise sap 15 SP2
5.32-7.8.1
fixed
suse enterprise sap 15 SP3
5.32-7.8.1
fixed
suse enterprise sap 15 SP4
5.32-7.8.1
fixed
suse enterprise sap 15 SP5
5.32-7.8.1
fixed
suse enterprise sap 15 SP6
5.32-7.8.1
fixed
suse enterprise sap 15 SP7
5.32-7.8.1
fixed
suse enterprise server 15 SP1
5.32-7.8.1
fixed
suse enterprise server 15 SP2
5.32-7.8.1
fixed
suse enterprise server 15 SP3
5.32-7.8.1
fixed
suse enterprise server 15 SP4
5.32-7.8.1
fixed
suse enterprise server 15 SP5
5.32-7.8.1
fixed
suse enterprise server 15 SP6
5.32-7.8.1
fixed
suse enterprise server 15 SP7
5.32-7.8.1
fixed
file-magic
suse enterprise desktop 15 SP1
5.32-7.8.1
fixed
suse enterprise desktop 15 SP2
5.32-7.8.1
fixed
suse enterprise desktop 15 SP3
5.32-7.8.1
fixed
suse enterprise desktop 15 SP4
5.32-7.8.1
fixed
suse enterprise desktop 15 SP5
5.32-7.8.1
fixed
suse enterprise desktop 15 SP6
5.32-7.8.1
fixed
suse enterprise desktop 15 SP7
5.32-7.8.1
fixed
suse enterprise sap 12 SP3
5.22-10.21.1
fixed
suse enterprise sap 12 SP4
5.22-10.21.1
fixed
suse enterprise sap 12 SP5
5.22-10.21.1
fixed
suse enterprise sap 15 SP1
5.32-7.8.1
fixed
suse enterprise sap 15 SP2
5.32-7.8.1
fixed
suse enterprise sap 15 SP3
5.32-7.8.1
fixed
suse enterprise sap 15 SP4
5.32-7.8.1
fixed
suse enterprise sap 15 SP5
5.32-7.8.1
fixed
suse enterprise sap 15 SP6
5.32-7.8.1
fixed
suse enterprise sap 15 SP7
5.32-7.8.1
fixed
suse enterprise server 12 SP2
5.22-10.21.1
fixed
suse enterprise server 12 SP3
5.22-10.21.1
fixed
suse enterprise server 12 SP4
5.22-10.21.1
fixed
suse enterprise server 12 SP5
5.22-10.21.1
fixed
suse enterprise server 15 SP1
5.32-7.8.1
fixed
suse enterprise server 15 SP2
5.32-7.8.1
fixed
suse enterprise server 15 SP3
5.32-7.8.1
fixed
suse enterprise server 15 SP4
5.32-7.8.1
fixed
suse enterprise server 15 SP5
5.32-7.8.1
fixed
suse enterprise server 15 SP6
5.32-7.8.1
fixed
suse enterprise server 15 SP7
5.32-7.8.1
fixed
libmagic1
suse enterprise desktop 15 SP1
5.32-7.8.1
fixed
suse enterprise desktop 15 SP2
5.32-7.8.1
fixed
suse enterprise desktop 15 SP3
5.32-7.8.1
fixed
suse enterprise desktop 15 SP4
5.32-7.8.1
fixed
suse enterprise desktop 15 SP5
5.32-7.8.1
fixed
suse enterprise desktop 15 SP6
5.32-7.8.1
fixed
suse enterprise desktop 15 SP7
5.32-7.8.1
fixed
suse enterprise sap 12 SP3
5.22-10.21.1
fixed
suse enterprise sap 12 SP4
5.22-10.21.1
fixed
suse enterprise sap 12 SP5
5.22-10.21.1
fixed
suse enterprise sap 15 SP1
5.32-7.8.1
fixed
suse enterprise sap 15 SP2
5.32-7.8.1
fixed
suse enterprise sap 15 SP3
5.32-7.8.1
fixed
suse enterprise sap 15 SP4
5.32-7.8.1
fixed
suse enterprise sap 15 SP5
5.32-7.8.1
fixed
suse enterprise sap 15 SP6
5.32-7.8.1
fixed
suse enterprise sap 15 SP7
5.32-7.8.1
fixed
suse enterprise server 12 SP2
5.22-10.21.1
fixed
suse enterprise server 12 SP3
5.22-10.21.1
fixed
suse enterprise server 12 SP4
5.22-10.21.1
fixed
suse enterprise server 12 SP5
5.22-10.21.1
fixed
suse enterprise server 15 SP1
5.32-7.8.1
fixed
suse enterprise server 15 SP2
5.32-7.8.1
fixed
suse enterprise server 15 SP3
5.32-7.8.1
fixed
suse enterprise server 15 SP4
5.32-7.8.1
fixed
suse enterprise server 15 SP5
5.32-7.8.1
fixed
suse enterprise server 15 SP6
5.32-7.8.1
fixed
suse enterprise server 15 SP7
5.32-7.8.1
fixed
libmagic1-32bit
suse enterprise desktop 15 SP1
5.32-7.8.1
fixed
suse enterprise desktop 15 SP2
5.32-7.8.1
fixed
suse enterprise desktop 15 SP3
5.32-7.8.1
fixed
suse enterprise desktop 15 SP4
5.32-7.8.1
fixed
suse enterprise desktop 15 SP5
5.32-7.8.1
fixed
suse enterprise desktop 15 SP6
5.32-7.8.1
fixed
suse enterprise desktop 15 SP7
5.32-7.8.1
fixed
suse enterprise sap 12 SP3
5.22-10.21.1
fixed
suse enterprise sap 12 SP4
5.22-10.21.1
fixed
suse enterprise sap 12 SP5
5.22-10.21.1
fixed
suse enterprise sap 15 SP1
5.32-7.8.1
fixed
suse enterprise sap 15 SP2
5.32-7.8.1
fixed
suse enterprise sap 15 SP3
5.32-7.8.1
fixed
suse enterprise sap 15 SP4
5.32-7.8.1
fixed
suse enterprise sap 15 SP5
5.32-7.8.1
fixed
suse enterprise sap 15 SP6
5.32-7.8.1
fixed
suse enterprise sap 15 SP7
5.32-7.8.1
fixed
suse enterprise server 12 SP2
5.22-10.21.1
fixed
suse enterprise server 12 SP3
5.22-10.21.1
fixed
suse enterprise server 12 SP4
5.22-10.21.1
fixed
suse enterprise server 12 SP5
5.22-10.21.1
fixed
suse enterprise server 15 SP1
5.32-7.8.1
fixed
suse enterprise server 15 SP2
5.32-7.8.1
fixed
suse enterprise server 15 SP3
5.32-7.8.1
fixed
suse enterprise server 15 SP4
5.32-7.8.1
fixed
suse enterprise server 15 SP5
5.32-7.8.1
fixed
suse enterprise server 15 SP6
5.32-7.8.1
fixed
suse enterprise server 15 SP7
5.32-7.8.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
file
RHEL 8
0:5.33-20.el8
fixed
file-devel
RHEL 8
0:5.33-20.el8
fixed
file-libs
RHEL 8
0:5.33-20.el8
fixed
python3-magic
RHEL 8
0:5.33-20.el8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
file
Amazon Linux 1
0:5.37-8.48.amzn1
fixed
Amazon Linux 2
0:5.11-35.amzn2.0.2
fixed
file-debuginfo
Amazon Linux 1
0:5.37-8.48.amzn1
fixed
Amazon Linux 2
0:5.11-35.amzn2.0.2
fixed
file-devel
Amazon Linux 1
0:5.37-8.48.amzn1
fixed
Amazon Linux 2
0:5.11-35.amzn2.0.2
fixed
file-libs
Amazon Linux 1
0:5.37-8.48.amzn1
fixed
Amazon Linux 2
0:5.11-35.amzn2.0.2
fixed
file-static
Amazon Linux 1
0:5.37-8.48.amzn1
fixed
Amazon Linux 2
0:5.11-35.amzn2.0.2
fixed
php72
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-bcmath
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-cli
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-common
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-dba
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-dbg
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-debuginfo
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-devel
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-embedded
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-enchant
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-fpm
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-gd
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-gmp
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-imap
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-intl
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-json
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-ldap
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-mbstring
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-mysqlnd
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-odbc
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-opcache
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-pdo
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-pdo-dblib
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-pgsql
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-process
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-pspell
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-recode
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-snmp
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-soap
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-tidy
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-xml
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php72-xmlrpc
Amazon Linux 1
0:7.2.26-1.19.amzn1
fixed
php73
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-bcmath
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-cli
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-common
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-dba
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-dbg
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-debuginfo
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-devel
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-embedded
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-enchant
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-fpm
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-gd
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-gmp
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-imap
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-intl
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-json
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-ldap
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-mbstring
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-mysqlnd
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-odbc
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-opcache
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-pdo
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-pdo-dblib
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-pgsql
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-process
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-pspell
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-recode
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-snmp
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-soap
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-tidy
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-xml
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
php73-xmlrpc
Amazon Linux 1
0:7.3.13-1.22.amzn1
fixed
python-magic
Amazon Linux 2
0:5.11-35.amzn2.0.2
fixed
python26-magic
Amazon Linux 1
0:5.37-8.48.amzn1
fixed
python27-magic
Amazon Linux 1
0:5.37-8.48.amzn1
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00044.html
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780
https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84
https://lists.debian.org/debian-lts-announce/2019/10/msg00032.html
https://lists.debian.org/debian-lts-announce/2021/07/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV6PFCEYHYALMTT45QE2U5C5TEJZQPXJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D6BJVGXSCC6NMIAWX36FPWHEIFON3OSE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VBK6XOJR6OVWT2FUEBO7V7KCOSSLAP52/
https://security.gentoo.org/glsa/202003-24
https://security.netapp.com/advisory/ntap-20200115-0001/
https://usn.ubuntu.com/4172-1/
https://usn.ubuntu.com/4172-2/
https://www.debian.org/security/2019/dsa-4550
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00044.html
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780
https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84
https://lists.debian.org/debian-lts-announce/2019/10/msg00032.html
https://lists.debian.org/debian-lts-announce/2021/07/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV6PFCEYHYALMTT45QE2U5C5TEJZQPXJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D6BJVGXSCC6NMIAWX36FPWHEIFON3OSE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VBK6XOJR6OVWT2FUEBO7V7KCOSSLAP52/
https://security.gentoo.org/glsa/202003-24
https://security.netapp.com/advisory/ntap-20200115-0001/
https://usn.ubuntu.com/4172-1/
https://usn.ubuntu.com/4172-2/
https://www.debian.org/security/2019/dsa-4550