USN-3911-1 fixed vulnerabilities in file. One of the backported security
fixes introduced a regression that caused the interpreter string to be
truncated. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that file incorrectly handled certain malformed ELF
files. An attacker could use this issue to cause a denial of service, or
possibly execute arbitrary code.
cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact.
do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360.
The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.