[ GLSA 201412-48 ] file

[GLSA]

Gentoo Linux Security Advisory

Title: file: Denial of Service (GLSA 201412-48)
Severity: normal
Exploitable: local, remote
Date: December 27, 2014
Bug(s): #532686
ID: 201412-48

Synopsis

A vulnerability in file could allow a context-dependent attack to
create a Denial of Service condition.


Background

The file utility attempts to identify a file’s format by scanning
binary data for patterns.


Affected Packages

Package: sys-apps/file
Vulnerable: < 5.21
Unaffected: >= 5.21
Architectures: All supported architectures


Description

An issue with the ELF parser used by the file utility can cause a
resource consumption when reading a specially-crafted ELF binary.


Impact

A context-dependent attacker may be able to cause Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All file users should upgrade to the latest version: