Mandrake Linux Security Advisory : file (MDKSA-2007:114)
High Nessus Plugin ID 25439
SynopsisThe remote Mandrake Linux host is missing one or more security updates.
DescriptionThe update to correct CVE-2007-1536 (MDKSA-2007:067), a buffer overflow in the file_printf() function, introduced a new integer overflow as reported by Colin Percival. This flaw, if an attacker could trick a user into running file on a specially crafted file, could possibly lead to the execution of arbitrary code with the privileges of the user running file (CVE-2007-2799).
As well, in file 4.20, flawed regular expressions to identify OS/2 REXX files could lead to a denial of service via CPU consumption (CVE-2007-2026).
The updated packages have been patched to correct these issues.
SolutionUpdate the affected packages.