CVE-2019-8906

Name of the Vulnerable Software and Affected Versions File version 5.35

Description The issue is related to an out-of-bounds read in the do core note function of the File utility, specifically in the readelf.c file within libmagic.a. This can lead to a denial of service. The problem arises from the misuse of memcpy, causing the function to read data beyond the boundaries of a buffer in memory.

Recommendations For File version 5.35, consider restricting access to the do core note function until a patch is available. As a temporary workaround, avoid using the File utility for determining file types from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.