——————————————————————————–
Fedora Update Notification
FEDORA-2014-7992
2014-07-01 22:36:30
——————————————————————————–

Name : file
Product : Fedora 20
Version : 5.19
Release : 1.fc20
URL : http://www.darwinsys.com/file/
Summary : A utility for determining file types
Description :
The file command is used to identify a particular file according to the
type of data contained by the file. File can identify many different
file types, including ELF binaries, system libraries, RPM packages, and
different graphics formats.

——————————————————————————–
Update Information:

Security update to new File version 5.19 fixing 8 CVEs found in previous two months.
——————————————————————————–
ChangeLog:

* Wed Jun 25 2014 Jan Kaluza <jkaluza@redhat.com> – 5.19-1
– fix #1011789 – update to version 5.19
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> – 5.14-22
– Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Tue May 27 2014 Kalev Lember <kalevlember@gmail.com> – 5.14-21
– Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4
* Tue Mar 25 2014 Jan Kaluza <jkaluza@redhat.com> – 5.14-20
– fix #1079847 – fix potential regression in Perl detection caused
by original patch for CVE-2013-7345
* Mon Mar 24 2014 Jan Kaluza <jkaluza@redhat.com> – 5.14-19
– fix redefinition of OFFSET_OOB in CVE-2014-2270 patch
* Mon Mar 24 2014 Jan Kaluza <jkaluza@redhat.com> – 5.14-18
– fix #1079847 – fix for CVE-2013-7345
– fix #1080450 – remove *.orig files before compiling magic/Magdir
* Fri Mar 7 2014 Jan Kaluza <jkaluza@redhat.com> – 5.14-17
– fix #1073555 – fix for CVE-2014-2270
* Tue Feb 25 2014 Jan Kaluza <jkaluza@redhat.com> – 5.14-16
– fix potential memory leak introduced in previous commit
* Tue Feb 18 2014 Jan Kaluza <jkaluza@redhat.com> – 5.14-15
– fix #1065837 – fix for CVE-2014-1943
* Wed Jan 15 2014 Jan Kaluza <jkaluza@redhat.com> – 5.14-14
– fix #1051598 – reverse the order of shebang vs. package keyword detection
in Perl by increasing strength of all Perl patterns
* Mon Sep 9 2013 Jan Kaluza <jkaluza@redhat.com> – 5.14-13
– fix #1001689 – fix segfault when calling magic_load twice
——————————————————————————–
References:

[ 1 ] Bug #805197 – CVE-2012-1571 file: out of bounds read in CDF parser
https://bugzilla.redhat.com/show_bug.cgi?id=805197
[ 2 ] Bug #1091842 – CVE-2014-0207 file: cdf_read_short_sector insufficient boundary check
https://bugzilla.redhat.com/show_bug.cgi?id=1091842
[ 3 ] Bug #1098222 – CVE-2014-3538 file: extensive backtracking in awk rule regular expression (incomplete fix for CVE-2013-7345)
https://bugzilla.redhat.com/show_bug.cgi?id=1098222
[ 4 ] Bug #1104858 – CVE-2014-3480 file: cdf_count_chain insufficient boundary check
https://bugzilla.redhat.com/show_bug.cgi?id=1104858
[ 5 ] Bug #1104863 – CVE-2014-3478 file: mconvert incorrect handling of truncated pascal string size
https://bugzilla.redhat.com/show_bug.cgi?id=1104863
[ 6 ] Bug #1104869 – CVE-2014-3479 file: cdf_check_stream_offset insufficient boundary check
https://bugzilla.redhat.com/show_bug.cgi?id=1104869
[ 7 ] Bug #1107544 – CVE-2014-3487 file: cdf_read_property_info insufficient boundary check
https://bugzilla.redhat.com/show_bug.cgi?id=1107544
[ 8 ] Bug #1098193 – CVE-2014-0237 file: cdf_unpack_summary_info() excessive looping DoS
https://bugzilla.redhat.com/show_bug.cgi?id=1098193
——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update file’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce