Skip to content
OpenAdvisories
Medium USN-2278-1 7 CVEs

file vulnerabilities

Published Jul 15, 2014 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Mike Frysinger discovered that the file awk script detector used multiple
wildcard with unlimited repetitions. An attacker could use this issue to
cause file to consume resources, resulting in a denial of service.
(CVE-2013-7345)

Francisco Alonso discovered that file incorrectly handled certain CDF
documents. A attacker could use this issue to cause file to hang or crash,
resulting in a denial of service. (CVE-2014-0207, CVE-2014-3478,
CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)

Jan Kaluža discovered that file did not properly restrict the amount of
data read during regex searches. An attacker could use this issue to
cause file to consume resources, resulting in a denial of service.
(CVE-2014-3538)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS file 1:5.14-2ubuntu3.1

Vulnerabilities 7

  • Medium 6.5
    CVE-2014-0207 EPSS 17%

    The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30…

    php5 file file Debian Ubuntu
  • Medium 6.5
    CVE-2014-3478 EPSS 15%

    Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP b…

    php5 file file Debian Ubuntu
  • Medium 6.5
    CVE-2014-3480 EPSS 11%

    The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5…

    php5 file file Debian Ubuntu
  • Unscored —
    CVE-2013-7345

    The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wild…

    file file Debian Ubuntu
  • Unscored —
    CVE-2014-3479 EPSS 15%

    The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.…

    php5 file file Debian Ubuntu
  • Unscored —
    CVE-2014-3487 EPSS 15%

    The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5…

    php5 file file Debian Ubuntu
  • Unscored —
    CVE-2014-3538 EPSS 12%

    file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attacker…

    file file Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2013-7345
  • report
    https://ubuntu.com/security/CVE-2014-0207
  • report
    https://ubuntu.com/security/CVE-2014-3478
  • report
    https://ubuntu.com/security/CVE-2014-3479
  • report
    https://ubuntu.com/security/CVE-2014-3480
  • report
    https://ubuntu.com/security/CVE-2014-3487
  • report
    https://ubuntu.com/security/CVE-2014-3538