Multiple buffer overflows in the (1) cdfreadsat, (2) cdfreadlongsectorchain, and (3) cdfreadssat function in file before 5.02.

Drew Yao of Apple Product Security discovered several memory corruption issues in file 5.00 in the CDF parsing implementation.

The first is an integer overflow in cdfreadpropertyinfo(), and the second is an integer overflow in cdfreadsat(). Both have been assigned CVE-2009-0947.

The third issue is buffer overflows in cdfreadsat(), cdfreadlongsectorchain(), and cdfreadssat(). These issues have been assigned CVE-2009-0948.

These issues only affect file 5.00, and not earlier versions, due to introduced support for CDF (Common Document Format) files in file 5.00. Because of this, only Fedora 11 is affected by these issues.