CVE-2017-1000249

An issue in file() was introduced in commit 9611f31313a93aa036389c5f3b15eea53510d4d1 (Oct 2016) lets an attacker overwrite a fixed 20 bytes stack buffer with a specially crafted .notes section in an ELF binary. This was fixed in commit 35c94dc6acc418f1ad7f6241a6680e5327495793 (Aug 2017).

• CWE-119

• http://www.debian.org/security/2017/dsa-3965
• https://github.com/file/file/commit/35c94dc6acc418f1ad7f6241a6680e5327495793Patch, Third Party Advisory
• https://github.com/file/file/commit/9611f31313a93aa036389c5f3b15eea53510d4dPatch, Third Party Advisory
• https://security.gentoo.org/glsa/201710-02
• http://www.debian.org/security/2017/dsa-3965
• https://github.com/file/file/commit/35c94dc6acc418f1ad7f6241a6680e5327495793Patch, Third Party Advisory
• https://github.com/file/file/commit/9611f31313a93aa036389c5f3b15eea53510d4dPatch, Third Party Advisory
• https://security.gentoo.org/glsa/201710-02

Published

Sep 11, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000243Jenkins Favorite Plugin 2.1.4 and older does not perform per…
• CVE-2017-1000244Jenkins Favorite Plugin version 2.2.0 and older is vulnerabl…
• CVE-2017-1000245The SSH Plugin stores credentials which allow jobs to access…
• CVE-2017-1000246Python package pysaml2 version 4.4.0 and earlier reuses the …
• CVE-2017-1000247British Columbia Institute of Technology CodeIgniter 3.1.3 i…
• CVE-2017-1000248Redis-store <=v1.3.0 allows unsafe objects to be loaded from…
• CVE-2017-1000250All versions of the SDP server in BlueZ 5.46 and earlier are…
• CVE-2017-1000251The native Bluetooth stack in the Linux Kernel (BlueZ), star…8
• CVE-2017-1000252The KVM subsystem in the Linux kernel through 4.13.3 allows …
• CVE-2017-1000253Linux distributions that have not patched their long-term ke…7.8
• CVE-2017-1000254libcurl may read outside of a heap allocated buffer when doi…
• CVE-2017-1000255On Linux running on PowerPC hardware (Power8 or later) a use…