Re: CVE Request: PHP/file: out-of-bounds memory access in softmagic

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> There are more such issues, I haven't tested them in php:
> http://bugs.gw.com/view.php?id=409
> http://mx.gw.com/pipermail/file/2014/001649.html

Our initial thought is that the 001649.html disclosure occurred first,
and has a single root cause that also applies to id=409. So, we don't
think that id=409 can have its own separate CVE ID, even though the
id=409 report contained additional detail.

Use CVE-2014-9653 for the entire "readelf.c uses pread() ... it's
happy with partial reads and valgrind show various errors" report
fixed by "file has been changed to bail out when pread() returns
partial buffers."

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJU06XtAAoJEKllVAevmvms2QQIAIxDhtDG27FFsr8hsZQMJYqa
4Jk9r2vXKb8hmM/xenVWmCwHxz67UjZ3wgL5lU6z5hJMRaLfR4tddIhhgK+I+9p/
MslcATfZyBzal1uXaiiN81sYs+PPUdWYf9wCaI/j+F8O9sl2690OeSUOn+S3T8vf
ZyMV2DIJnDYVo4TK+6xjuYnk1Tcq2sqvWO5BK07+pNAbtsWk4TikurSEuBc1KLSD
TJ6LBOgf/HZPGqCx3PX+oKP/oN/OPP5mp31qM5A8RNjt3gYoqNhDQQ4uo7lYTUCH
xy14S2XfNwvD+YNhBam1Vn+5+MxNqiEjuoOQ1ztP5Jb86A8fQdyfxS0lyVWSn18=
=WfCL
-----END PGP SIGNATURE-----