file-5.11-31.el7

The file command is used to identify a particular file according to the
type of data contained by the file. File can identify many different
file types, including ELF binaries, system libraries, RPM packages, and
different graphics formats.

Security issues fixed with this release:

CVE-2014-0207
The cdf_read_short_sector function in cdf.c in file before 5.19, as
used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before
5.5.14, allows remote attackers to cause a denial of service
(assertion failure and application exit) via a crafted CDF file.
CVE-2014-0237
The cdf_unpack_summary_info function in cdf.c in the Fileinfo
component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote
attackers to cause a denial of service (performance degradation) by
triggering many file_printf calls.
CVE-2014-0238
The cdf_read_property_info function in cdf.c in the Fileinfo component
in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers
to cause a denial of service (infinite loop or out-of-bounds memory
access) via a vector that (1) has zero length or (2) is too long.
CVE-2014-3478
Buffer overflow in the mconvert function in softmagic.c in file before
5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x
before 5.5.14, allows remote attackers to cause a denial of service
(application crash) via a crafted Pascal string in a FILE_PSTRING
conversion.
CVE-2014-3479
The cdf_check_stream_offset function in cdf.c in file before 5.19, as
used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before
5.5.14, relies on incorrect sector-size data, which allows remote
attackers to cause a denial of service (application crash) via a
crafted stream offset in a CDF file.
CVE-2014-3480
The cdf_count_chain function in cdf.c in file before 5.19, as used in
the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14,
does not properly validate sector-count data, which allows remote
attackers to cause a denial of service (application crash) via a
crafted CDF file.
CVE-2014-3487
The cdf_read_property_info function in file before 5.19, as used in
the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14,
does not properly validate a stream offset, which allows remote
attackers to cause a denial of service (application crash) via a
crafted CDF file.
CVE-2014-3538
file before 5.19 does not properly restrict the amount of data read
during a regex search, which allows remote attackers to cause a denial
of service (CPU consumption) via a crafted file that triggers
backtracking during processing of an awk rule. NOTE: this
vulnerability exists because of an incomplete fix for CVE-2013-7345.
CVE-2014-3587
Integer overflow in the cdf_read_property_info function in cdf.c in
file through 5.19, as used in the Fileinfo component in PHP before
5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a
denial of service (application crash) via a crafted CDF file. NOTE:
this vulnerability exists because of an incomplete fix for
CVE-2012-1571.
CVE-2014-3710
The donote function in readelf.c in file through 5.20, as used in the
Fileinfo component in PHP 5.4.34, does not ensure that sufficient note
headers are present, which allows remote attackers to cause a denial
of service (out-of-bounds read and application crash) via a crafted
ELF file.
CVE-2014-8116
The ELF parser (readelf.c) in file before 5.21 allows remote attackers
to cause a denial of service (CPU consumption or crash) via a large
number of (1) program or (2) section headers or (3) invalid
capabilities.
CVE-2014-8117
softmagic.c in file before 5.21 does not properly limit recursion,
which allows remote attackers to cause a denial of service (CPU
consumption or crash) via unspecified vectors.
CVE-2014-9652
The mconvert function in softmagic.c in file before 5.21, as used in
the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and
5.6.x before 5.6.5, does not properly handle a certain string-length
field during a copy of a truncated version of a Pascal string, which
might allow remote attackers to cause a denial of service
(out-of-bounds memory access and application crash) via a crafted
file.
CVE-2014-9653
readelf.c in file before 5.22, as used in the Fileinfo component in
PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does
not consider that pread calls sometimes read only a subset of the
available data, which allows remote attackers to cause a denial of
service (uninitialized memory access) or possibly have unspecified
other impact via a crafted ELF file.