-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2014-7992 2014-07-01 22:36:30 --------------------------------------------------------------------------------
Name : file Product : Fedora 20 Version : 5.19 Release : 1.fc20 URL : http://www.darwinsys.com/file/ Summary : A utility for determining file types Description : The file command is used to identify a particular file according to the type of data contained by the file. File can identify many different file types, including ELF binaries, system libraries, RPM packages, and different graphics formats.
-------------------------------------------------------------------------------- Update Information:
Security update to new File version 5.19 fixing 8 CVEs found in previous two months. -------------------------------------------------------------------------------- ChangeLog:
* Wed Jun 25 2014 Jan Kaluza jkaluza@redhat.com - 5.19-1 - fix #1011789 - update to version 5.19 * Sat Jun 7 2014 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 5.14-22 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild * Tue May 27 2014 Kalev Lember kalevlember@gmail.com - 5.14-21 - Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4 * Tue Mar 25 2014 Jan Kaluza jkaluza@redhat.com - 5.14-20 - fix #1079847 - fix potential regression in Perl detection caused by original patch for CVE-2013-7345 * Mon Mar 24 2014 Jan Kaluza jkaluza@redhat.com - 5.14-19 - fix redefinition of OFFSET_OOB in CVE-2014-2270 patch * Mon Mar 24 2014 Jan Kaluza jkaluza@redhat.com - 5.14-18 - fix #1079847 - fix for CVE-2013-7345 - fix #1080450 - remove *.orig files before compiling magic/Magdir * Fri Mar 7 2014 Jan Kaluza jkaluza@redhat.com - 5.14-17 - fix #1073555 - fix for CVE-2014-2270 * Tue Feb 25 2014 Jan Kaluza jkaluza@redhat.com - 5.14-16 - fix potential memory leak introduced in previous commit * Tue Feb 18 2014 Jan Kaluza jkaluza@redhat.com - 5.14-15 - fix #1065837 - fix for CVE-2014-1943 * Wed Jan 15 2014 Jan Kaluza jkaluza@redhat.com - 5.14-14 - fix #1051598 - reverse the order of shebang vs. package keyword detection in Perl by increasing strength of all Perl patterns * Mon Sep 9 2013 Jan Kaluza jkaluza@redhat.com - 5.14-13 - fix #1001689 - fix segfault when calling magic_load twice -------------------------------------------------------------------------------- References:
[ 1 ] Bug #805197 - CVE-2012-1571 file: out of bounds read in CDF parser https://bugzilla.redhat.com/show_bug.cgi?id=805197 [ 2 ] Bug #1091842 - CVE-2014-0207 file: cdf_read_short_sector insufficient boundary check https://bugzilla.redhat.com/show_bug.cgi?id=1091842 [ 3 ] Bug #1098222 - CVE-2014-3538 file: extensive backtracking in awk rule regular expression (incomplete fix for CVE-2013-7345) https://bugzilla.redhat.com/show_bug.cgi?id=1098222 [ 4 ] Bug #1104858 - CVE-2014-3480 file: cdf_count_chain insufficient boundary check https://bugzilla.redhat.com/show_bug.cgi?id=1104858 [ 5 ] Bug #1104863 - CVE-2014-3478 file: mconvert incorrect handling of truncated pascal string size https://bugzilla.redhat.com/show_bug.cgi?id=1104863 [ 6 ] Bug #1104869 - CVE-2014-3479 file: cdf_check_stream_offset insufficient boundary check https://bugzilla.redhat.com/show_bug.cgi?id=1104869 [ 7 ] Bug #1107544 - CVE-2014-3487 file: cdf_read_property_info insufficient boundary check https://bugzilla.redhat.com/show_bug.cgi?id=1107544 [ 8 ] Bug #1098193 - CVE-2014-0237 file: cdf_unpack_summary_info() excessive looping DoS https://bugzilla.redhat.com/show_bug.cgi?id=1098193 --------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use su -c 'yum update file' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
package-announce@lists.fedoraproject.org