CVE-2019-8906CWE-125

CVE-2019-8906

Medium · published February 18, 2019

CVSS v3.1
4.4
EPSS
0%
Percentile
41.4
In the wild
Unconfirmed
What it is

do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00493 · 41.4th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2019-02-18T22:29Z
Affected products (10)
ProductVersionsFixed in
file_project/fileall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
opensuse/leapall versions—
opensuse/leapall versions—
apple/iphone_os< 12.212.2
apple/mac_os_x< 10.14.410.14.4
apple/tvos< 12.212.2
apple/watchos< 5.25.2
References (18)
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html · [email protected]https://bugs.astron.com/view.php?id=64 · [email protected]https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f · [email protected]https://support.apple.com/kb/HT209599 · [email protected]https://support.apple.com/kb/HT209600 · [email protected]https://support.apple.com/kb/HT209601 · [email protected]https://support.apple.com/kb/HT209602 · [email protected]https://usn.ubuntu.com/3911-1/ · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html · af854a3a-2127-422b-91ae-364da2661108https://bugs.astron.com/view.php?id=64 · af854a3a-2127-422b-91ae-364da2661108https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT209599 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT209600 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT209601 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT209602 · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/3911-1/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 18 FEB 17:00Z
    do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused
    cvelistv5