CVE Feed

    Dashboard / CVE / CVE-2017-1000249

    CVE-2017-1000249

    An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793 (Aug 2017).

    Published:Sep 5, 2017
    Last Modified:Apr 20, 2025
    EPS:Sep 11, 2017
    EPSS Score:0.00073
    CVSS Score:5.5

    Affected Products

    Vendor
    File Project
    Product
    File

    Exploits

    No exploit reference

    Related CVEs

    CVE-2022-48554 (CVSS 5.5) — File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of a…
    CVE-2019-18218 (CVSS 7.8) — cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, whic…
    CVE-2019-8905 (CVSS 4.4) — do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_print…
    CVE-2019-8904 (CVSS 8.8) — do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf…
    CVE-2019-8906 (CVSS 4.4) — do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.…
    CVE-2019-8907 (CVSS 8.8) — do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (sta…
    CVE-2018-10360 (CVSS 6.5) — The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of…
    CVE-2014-9620 (CVSS 5) — The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large numb…
    CVE-2014-9621 (CVSS 5) — The ELF parser in file 5.16 through 5.21 allows remote attackers to cause a denial of service via a long strin…
    CVE-2014-8117 (CVSS 5) — softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a de…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High