CVE-2019-18218: Buffer Overflow
cdfreadpropertyinfo in cdf.c in file through 5.37 does not restrict the number of CDFVECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/fileto a version that resolves this vulnerability.Fixed in 1:5.39-3+deb11u1Fixed in 1:5.44-3Fixed in 1:5.46-5
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-18218.
What is the severity of CVE-2019-18218?
The severity of CVE-2019-18218 is high.
How does CVE-2019-18218 affect the affected software?
CVE-2019-18218 affects the 'file' package in Ubuntu, Debian, openSUSE Leap, Netapp Active Iq Unified Manager, and Fedora.
How can I fix CVE-2019-18218?
To fix CVE-2019-18218, update the 'file' package to version 5.32-2ubuntu0.3 or later for Ubuntu, 5.35-4+deb10u2 or later for Debian, 15.1 or later for openSUSE Leap, 7.3 or later for Netapp Active Iq Unified Manager, and 29 or later for Fedora.
Where can I find more information about CVE-2019-18218?
You can find more information about CVE-2019-18218 at the following references: [LINK1], [LINK2], [LINK3].