| Description: | Summary:
The remote host is missing an update for the 'file' package(s) announced via the SSA:2007-093-01 advisory.
Vulnerability Insight:
New file packages are available for Slackware 8.1, 9.0, 9.1,
10.0, 10.1, 10.2, 11.0, and -current to fix a security issue.
NOTE: In Slackware 11.0 and earlier, the file utility was part
of the required 'bin' package, so this patch is needed even if
your machine does not have a 'file' package installed (which,
if you're not running Slackware -current, it probably does not).
More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:
[link moved to references]
Here are the details from the Slackware 11.0 ChangeLog:
+--------------------------+
patches/packages/file-4.20-i486-1_slack11.0.tgz:
Upgraded to file-4.20.
This fixes a heap overflow that could allow code to be executed as the
user running file (note that there are many scenarios where file might be
used automatically, such as in virus scanners or spam filters).
For more information, see:
[link moved to references]
(* Security fix *)
+--------------------------+
Affected Software/OS:
'file' package(s) on Slackware 8.1, Slackware 9.0, Slackware 9.1, Slackware 10.0, Slackware 10.1, Slackware 10.2, Slackware 11.0, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
