CVE-2017-1000249
Fixed in a distro release EPSS <1%
An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793 (Aug 2017).
Products: file_project file
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | file | 1:5.32-1 |
| Debian 13 | file | 1:5.32-1 |
| Debian 14 | file | 1:5.32-1 |
| Debian 9 | file | 1:5.30-1+deb9u1 |
| openSUSE Tumbleweed | file | 5.40-1.14 |