CVE-2019-18218

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-18218
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-18218.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-18218
Downstream
ALPINE (1)
BELL (1)
CLSA (2)
DEBIAN (1)
MGASA (1)
openSUSE (2)
RHSA (1)
RLSA (1)
SUSE (2)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (2)
Published
2019-10-21T05:15:10Z
Modified
2026-07-08T17:16:56Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:linux:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "7.3"
                }
            ],
            "source":  "CPE_RANGE",
            "vendor_product":  "netapp:active_iq_unified_manager"
        },
        {
            "cpes":  [
                "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "12.04"
                },
                {
                    "last_affected":  "12.04"
                },
                {
                    "introduced":  "14.04"
                },
                {
                    "last_affected":  "14.04"
                },
                {
                    "introduced":  "16.04"
                },
                {
                    "last_affected":  "16.04"
                },
                {
                    "introduced":  "18.04"
                },
                {
                    "last_affected":  "18.04"
                },
                {
                    "introduced":  "19.04"
                },
                {
                    "last_affected":  "19.04"
                },
                {
                    "introduced":  "19.10"
                },
                {
                    "last_affected":  "19.10"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "canonical:ubuntu_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.0"
                },
                {
                    "last_affected":  "8.0"
                },
                {
                    "introduced":  "9.0"
                },
                {
                    "last_affected":  "9.0"
                },
                {
                    "introduced":  "10.0"
                },
                {
                    "last_affected":  "10.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "29"
                },
                {
                    "last_affected":  "29"
                },
                {
                    "introduced":  "30"
                },
                {
                    "last_affected":  "30"
                },
                {
                    "introduced":  "31"
                },
                {
                    "last_affected":  "31"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "fedoraproject:fedora"
        },
        {
            "cpes":  [
                "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "15.1"
                },
                {
                    "last_affected":  "15.1"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "opensuse:leap"
        }
    ]
}
References

Affected packages

Git / github.com/file/file

Affected ranges

Type
GIT
Repo
https://github.com/file/file
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
a0d5b0e4e9f97d74a9911e95cedd579852e25398
Fixed
46a8443f76cec4b41ec736eca396984c74664f84
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:file_project:file:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "5.37"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

Other
FILE3_27
FILE3_28
FILE3_30
FILE3_31
FILE3_32
FILE3_33
FILE3_34
FILE3_35
FILE3_36
FILE3_37
FILE3_38
FILE3_39
FILE3_40
FILE3_41
FILE4_00
FILE4_01
FILE4_02
FILE4_03
FILE4_04
FILE4_05
FILE4_06
FILE4_07
FILE4_08
FILE4_09
FILE4_10
FILE4_11
FILE4_12
FILE4_13
FILE4_14
FILE4_15
FILE4_16
FILE4_17
FILE4_18
FILE4_19
FILE4_20
FILE4_21
FILE4_22
FILE4_23
FILE4_24
FILE4_25
FILE4_26
FILE5_00
FILE5_01
FILE5_02
FILE5_03
FILE5_04
FILE5_07
FILE5_08
FILE5_09
FILE5_10
FILE5_11
FILE5_12
FILE5_13
FILE5_14
FILE5_15
FILE5_16
FILE5_17
FILE5_18
FILE5_19
FILE5_20
FILE5_21
FILE5_22
FILE5_23
FILE5_24
FILE5_25
FILE5_26
FILE5_27
FILE5_28
FILE5_29
FILE5_30
FILE5_31
FILE5_32
FILE5_33
FILE5_34
FILE5_35
FILE5_36
FILE5_37
pre-rrt-big-changes-post-4-23

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-18218.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "141462265533073168588410924988499256220",
            "length":  4060
        },
        "id":  "CVE-2019-18218-124a6812",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84",
        "target":  {
            "file":  "src/cdf.c",
            "function":  "cdf_read_property_info"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "232348618922950287035341901861972145872",
                "338533911114036514584387668062207342846",
                "326674587567267172409291237374634580764",
                "264564310128975935481162260876263917724",
                "246134627259958658615817409114321934769",
                "190950152636129980836088233351599417731",
                "333926495558274210915114571492543351460",
                "263999937339594604155784173374512471434",
                "152715470018542414313236424384854217638",
                "100274328262298050445601681789737821828",
                "87563207867777330957918320582015450416",
                "38824614804368571099286801056625173862",
                "142503734579567137890548824060177062290"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2019-18218-4601ee86",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84",
        "target":  {
            "file":  "src/cdf.c"
        }
    }
]
vanir_signatures_modified 
"2026-07-08T17:16:56Z"