[SECURITY] Fedora 20 Update: file-5.19-1.fc20

[updates at fedoraproject.org]

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-7992
2014-07-01 22:36:30
--------------------------------------------------------------------------------

Name        : file
Product     : Fedora 20
Version     : 5.19
Release     : 1.fc20
URL         : http://www.darwinsys.com/file/
Summary     : A utility for determining file types
Description :
The file command is used to identify a particular file according to the
type of data contained by the file.  File can identify many different
file types, including ELF binaries, system libraries, RPM packages, and
different graphics formats.

--------------------------------------------------------------------------------
Update Information:

Security update to new File version 5.19 fixing 8 CVEs found in previous two months.
--------------------------------------------------------------------------------
ChangeLog:

* Wed Jun 25 2014 Jan Kaluza <jkaluza at redhat.com> - 5.19-1
- fix #1011789 - update to version 5.19
* Sat Jun  7 2014 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 5.14-22
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Tue May 27 2014 Kalev Lember <kalevlember at gmail.com> - 5.14-21
- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4
* Tue Mar 25 2014 Jan Kaluza <jkaluza at redhat.com> - 5.14-20
- fix #1079847 - fix potential regression in Perl detection caused
  by original patch for CVE-2013-7345
* Mon Mar 24 2014 Jan Kaluza <jkaluza at redhat.com> - 5.14-19
- fix redefinition of OFFSET_OOB in CVE-2014-2270 patch
* Mon Mar 24 2014 Jan Kaluza <jkaluza at redhat.com> - 5.14-18
- fix #1079847 - fix for CVE-2013-7345
- fix #1080450 - remove *.orig files before compiling magic/Magdir
* Fri Mar  7 2014 Jan Kaluza <jkaluza at redhat.com> - 5.14-17
- fix #1073555 - fix for CVE-2014-2270
* Tue Feb 25 2014 Jan Kaluza <jkaluza at redhat.com> - 5.14-16
- fix potential memory leak introduced in previous commit
* Tue Feb 18 2014 Jan Kaluza <jkaluza at redhat.com> - 5.14-15
- fix #1065837 - fix for CVE-2014-1943
* Wed Jan 15 2014 Jan Kaluza <jkaluza at redhat.com> - 5.14-14
- fix #1051598 - reverse the order of shebang vs. package keyword detection
  in Perl by increasing strength of all Perl patterns
* Mon Sep  9 2013 Jan Kaluza <jkaluza at redhat.com> - 5.14-13
- fix #1001689 - fix segfault when calling magic_load twice
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #805197 - CVE-2012-1571 file: out of bounds read in CDF parser
        https://bugzilla.redhat.com/show_bug.cgi?id=805197
  [ 2 ] Bug #1091842 - CVE-2014-0207 file: cdf_read_short_sector insufficient boundary check
        https://bugzilla.redhat.com/show_bug.cgi?id=1091842
  [ 3 ] Bug #1098222 - CVE-2014-3538 file: extensive backtracking in awk rule regular expression (incomplete fix for CVE-2013-7345)
        https://bugzilla.redhat.com/show_bug.cgi?id=1098222
  [ 4 ] Bug #1104858 - CVE-2014-3480 file: cdf_count_chain insufficient boundary check
        https://bugzilla.redhat.com/show_bug.cgi?id=1104858
  [ 5 ] Bug #1104863 - CVE-2014-3478 file: mconvert incorrect handling of truncated pascal string size
        https://bugzilla.redhat.com/show_bug.cgi?id=1104863
  [ 6 ] Bug #1104869 - CVE-2014-3479 file: cdf_check_stream_offset insufficient boundary check
        https://bugzilla.redhat.com/show_bug.cgi?id=1104869
  [ 7 ] Bug #1107544 - CVE-2014-3487 file: cdf_read_property_info insufficient boundary check
        https://bugzilla.redhat.com/show_bug.cgi?id=1107544
  [ 8 ] Bug #1098193 - CVE-2014-0237 file: cdf_unpack_summary_info() excessive looping DoS
        https://bugzilla.redhat.com/show_bug.cgi?id=1098193
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use
su -c 'yum update file' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------