Skip to content
OpenAdvisories
Unscored USN-3686-1 5 CVEs

file vulnerabilities

Published Jun 14, 2018 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Alexander Cherepanov discovered that file incorrectly handled a large
number of notes. An attacker could use this issue to cause a denial of
service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9620)

Alexander Cherepanov discovered that file incorrectly handled certain long
strings. An attacker could use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9621)

Alexander Cherepanov discovered that file incorrectly handled certain
malformed ELF files. An attacker could use this issue to cause a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 14.04 LTS. (CVE-2014-9653)

It was discovered that file incorrectly handled certain magic files. An
attacker could use this issue with a specially crafted magic file to cause
a denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 14.04 LTS. (CVE-2015-8865)

It was discovered that file incorrectly handled certain malformed ELF
files. An attacker could use this issue to cause a denial of service.
(CVE-2018-10360)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS file 1:5.14-2ubuntu3.4
Ubuntu · 16.04 LTS 16.04:LTS file 1:5.25-2ubuntu1.1
Ubuntu · 18.04 LTS 18.04:LTS file 1:5.32-2ubuntu0.1

Vulnerabilities 5

  • Unscored —
    CVE-2014-9620

    The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large number of not…

    file file Debian Ubuntu
  • Unscored —
    CVE-2014-9621

    The ELF parser in file 5.16 through 5.21 allows remote attackers to cause a denial of service via a long string.

    file file Debian Ubuntu
  • Unscored —
    CVE-2014-9653

    readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x b…

    file file Debian Ubuntu
  • Unscored —
    CVE-2015-8865

    The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6…

    php5 php7.0 file file Debian Ubuntu
  • Unscored —
    CVE-2018-10360

    The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service …

    file file Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-9620
  • report
    https://ubuntu.com/security/CVE-2014-9621
  • report
    https://ubuntu.com/security/CVE-2014-9653
  • report
    https://ubuntu.com/security/CVE-2015-8865
  • report
    https://ubuntu.com/security/CVE-2018-10360