Release Date: | 2007-03-20 |
Integer underflow in the file_printf function in the file program before 4.20 allows user-assisted attackers to execute arbitrary code via a file that triggers a heap-based buffer overflow. Integer overflow in the file program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement. NOTE: this issue is due to an incorrect patch for CVE-2007-1536.
See more information about CVE-2007-1536 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS v2.0 metrics and score provided are preliminary and subject to review.
Base Score: | 9.3 | Base Metrics: | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Access Vector: | Network | Attack Complexity: | Medium |
Authentication: | None required | Confidentiality Impact: | Complete |
Integrity Impact: | Complete | Availability Impact: | Complete |
Platform | Errata | Release Date |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team