Description
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | file | 1:5.22+15-1 | — |
| Debian 13 | file | 1:5.22+15-1 | — |
| Debian 12 | file | 1:5.22+15-1 | — |
| Debian 7 | file | 5.11-2+deb7u8 | DSA-3196-1 |
| Debian 6.0 | file | 5.04-5+squeeze10 | DLA-204-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | file | 1:5.32-2ubuntu0.1 | USN-3686-1 |
| Ubuntu 16.04 LTS | file | 1:5.25-2ubuntu1.1 | USN-3686-1 |
| Ubuntu 14.04 LTS | file | 1:5.14-2ubuntu3.4 | USN-3686-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | file +4 | 5.11-31.el7 | RHSA-2015:2155 |
| RHEL 6 | file +4 | 5.04-30.el6 | RHSA-2016:0760 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | file +1 | 5.22-10.3.1 | SUSE-SU-2017:3048-1 |
| SLES 12 SP2 | file +1 | 5.22-10.3.1 | SUSE-SU-2017:3048-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP3 | file | 5.22-10.3.1 | SUSE-SU-2017:3048-1 |
| SLES for SAP 12 SP2 | file | 5.22-10.3.1 | SUSE-SU-2017:3048-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | file +4 | 5.11-31.el7 | ELSA-2015-2155 |
Advisories 7
- RHSA-2016:0760 Red Hat Security Advisory: file security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:2155 Red Hat Security Advisory: file security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-3686-1 file vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-204-1 file - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3196-1 file - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2017:3048-1 Security update for file SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2015-2155 Moderate: file security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 23, 2015
References
- HPSBMU03409 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- USN-3686-1 vendor-advisory
- [oss-security] 20150205 Re: CVE Request: PHP/file: out-of-bounds memory access in softmagic mailing-list
- DSA-3196 vendor-advisory
- HPSBMU03380 vendor-advisory
- RHSA-2016:0760 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- http://php.net/ChangeLog-5.php
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- [file] 20141216 [PATCH] readelf.c: better checks for values returned by pread mailing-list
- http://bugs.gw.com/view.php?id=409
- https://github.com/file/file/commit/445c8fb0ebff85195be94cd9f7e1df89cade5c7f
- 72516 vdb-entry
- GLSA-201701-42 vendor-advisory