Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.0626.2
[DLA 1698] file security update
2 December 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: file
Publisher: Debian
Operating System: Debian GNU/Linux 8
Linux variants
Impact/Access: Denial of Service -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2019-8907 CVE-2019-8905
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2019/02/msg00044.html
https://lists.debian.org/debian-lts-announce/2019/11/msg00037.html
Comment: This bulletin contains two (2) Debian security advisories.
This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running file check for an updated version of the software for their
operating system.
Revision History: December 2 2019: Vendor published an update advising of a regression & fix
March 1 2019: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Package : file
Version : 1:5.22+15-2+deb8u5
CVE ID : CVE-2019-8905 CVE-2019-8907
Potential buffer over-reads in readelf.c have been found in file,
a popular file type guesser.
For Debian 8 "Jessie", these problems have been fixed in version
1:5.22+15-2+deb8u5.
We recommend that you upgrade your file packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAlx4WQgACgkQiNJCh6LY
mLFPvA/+JlbswU6orYbPqRKG7UQzYjicS9/kt74mBQLBk4pGZ7DIv2VaQFJD2MlX
+MvO1YLMBp8cjqqoJoEMV8gE5GEc6L2coRFunXnPmWNocnEmpwMQgtPpYYgPRlkK
Rk4Ezc7/9CKBCJzGrMMM0ykjrWQlpnkQ+hk3VeFGewhZr9u8uakjTvzWrQIlFiAP
DQk+0mD0koS8+P9H5RdY5UT+5H3frhsclQ+kKCVA2bDzV4oyTvz0RFh0yxewp5jh
9LqeT+XiXD2YegkqIzWhDPwEXjnRpjtnOpRzmqxdZe5QEDx+L/SQDYrS+gjpPq4O
TgZEC+FPuzW5yNhGuuKtdUTUbgZyKoFgbiqWJaDjqCsWcJo8NET+4zx3j3XTL8hn
ulYtlM51MjDxCwxRzrr8CJgSI4OhVfh5ZOpNSKZb8KUkoPrggjogFf4D6eqJ2PYS
LYbEr8ccAslDj60FJ1h5hl6zfL4Z1jT8mC8ZubmfxrzgkLcGSgy3QJJRgcoEb0KW
nzZgytQ1FnzQCQ6tuU9uJ0+hmdoX5lBqOjjtN4d3/8n9JP2naGJGSHwv1YQEhYJj
wJ2ATlfKCHZnt746QLPoUurMdFGzjpRuu9YRkIEIZx3H/Q1OVzdmBxh4+TQ0NAEd
1Dai3MN8i+JrRsmo6jx8w4KSBf2o737Y+bk2fwit8gt2LeL5CTc=
=ucZa
- -----END PGP SIGNATURE-----
- --------------------------------------------------------------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Package : file
Version : 1:5.22+15-2+deb8u7
This update fixes a regression in introduced in 1:5.22+15-2+deb8u5
causing truncated output of the interpreter name, thanks to Christoph
Biedl for reporting the problem and cause.
For Debian 8 "Jessie", this problem has been fixed in version
1:5.22+15-2+deb8u7.
We recommend that you upgrade your file packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAl3i1AUACgkQiNJCh6LY
mLG7gg/9GFwPDcVPHzDf2mYamzh6Or+iIWgEb/nMSc1YHF8kbaoH+9BkL6UNdUkl
RhCvCGngKgOS08tvKFIXEayR4TxD4+wFYaRQ/NUe8Fris7vh21a2VNM44gWB0Tp6
LwWNbzS3DvZRQra4XfPNXJyJa2rnF0Gt/0iULU1YoCoNbHq1yBF6SoiMnmReK7DE
6gOUxMLx1EFKAOGtSakgz1hO1n+NQs1A4SolfVlROnBxwS8Eu5dLFowHHEfcR5l9
bgKxB8ep00E38G63SSYtToKWlZkeFpnKF7UesBrfO5S2W/X03tOMZgpKssO0IipE
G4ySBHzVvwDq1+CLHKUp0mg8/a12vanLDNIibFRDixftoeO4m7p83EMVUhjZVzd/
cThC+fOpe3ORIcbo9HMQmFCH06YXjsFcxjnn47vbSSifkWn5sNlOc1ZUFP7aAq9Z
VvstJLB+ZFv6c74RLNhR7K16oK5Xd5/6IRjStnDXBz7qMu68LK6YWVxAfrVb1ApE
bl8PBzEHfgai/Wjol4Loh02s0RNg9ffQR9HlBE6XPJvOvspNaEIvaNT5mBv+nbwe
Qk1bQEOE12eNbfkHwW69R/ZClHqsW3TX536HnzSZ2M2WYqfAi+T3DO4WHythCBq4
3W23WxtWGk3MVFgFzcevcZ75wKRERO1v32u2vFtEjcet4XW25D4=
=7FAn
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXeRlgGaOgq3Tt24GAQjicRAAvYl/1zcuNXZKm14E9LWWCWQtUwR4Bb0Z
AG7VxQvFQTWNe6sqD86wHeP6sreyEaNHry4RroOOsk0GqTcha8AmKwjDKYE3G7o6
JATkOX9z3uY3gKY4AZY37DTQKVRgxdoNSRN+zWv1LEPhMo3zJsvfvfAKxUFMV3E7
Cgcr3ecGaib1BlLzY08zr6VkVTuW1Cwp7HWJk0ij6HSbrL2CxqUQRGcNq45k7QCO
dpBBX/C3quA50NDYheYSlNyLl3fLioiPC7eYYlZ+rLXw/ABZ3Qmoqv9YVZ7x3YIy
t2/yugh1NMX2JzNiovuShC1teyYK7JsPZify3hLqoFSc3LCvTqBpXXh54wFVEwWn
ohw60Bgo3MUrWXA5uyIxsVFGHXApVrpPX3q1mmeG4XGDBciSr367yx2TDtI5p8ra
y4xz7sSutxX3gLJ/YRWUbE/oF2t9dySzGFGUABoSwUR7SrkqKFAanNs4M/PaSRte
iCdX6p8I1neZdgfIffi6yGUP29/CrMms+jju9ii64S6FrMzioqo6LDea3+6if48V
8FXSvXlM0+IV7dA7HPCeEvYWkE6mGmAuSrh3P/xZT0GzXs7V7ELgF7+39R4LCeho
bVRj61wfgbPhjFIRywHCn1tpFcXn72Es7pZY4yVtNYsHGQuU0mGYsaKsCxia57Ri
BbYqMOXQM/A=
=Bz4P
-----END PGP SIGNATURE-----