What’s Vulnerable › Vulnerabilities

CVE-2019-8906

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-02-18 · updated 2026-10-08
• Weakness: CWE-125

Description

do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.

Affected products

• Apple Iphone Os: before 12.2 — fixed in 12.2
• macOS: before 10.14.4 — fixed in 10.14.4
• Apple tvOS: before 12.2 — fixed in 12.2
• Apple watchOS: before 5.2 — fixed in 5.2
• Canonical Ubuntu Linux: 16.04, 18.04, 18.10
• File Project File: 5.35
• openSUSE Leap: 15.0, 42.3

How to fix

Upgrade to a fixed version: Apple Iphone Os 12.2; macOS 10.14.4; Apple tvOS 12.2; Apple watchOS 5.2. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html
• https://bugs.astron.com/view.php?id=64
• https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f
• https://support.apple.com/kb/HT209599
• https://support.apple.com/kb/HT209600
• https://support.apple.com/kb/HT209601
• https://support.apple.com/kb/HT209602
• https://usn.ubuntu.com/3911-1/
• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html
• https://bugs.astron.com/view.php?id=64

Get alerted when CVE-2019-8906 or the next vulnerability affects your stack