CVE-2009-0947: 
Linux Debian vulnerability analysis and mitigation

Multiple integer overflows were discovered in the file utility before version 5.02, specifically affecting the cdf_read_property_info and cdf_read_sat functions. The vulnerability was assigned CVE-2009-0947 and was discovered by Drew Yao of Apple Product Security. The issue specifically impacted the CDF (Common Document Format) parsing implementation introduced in file version 5.00 (Red Hat Bugzilla).

The vulnerability received a CVSS v3.1 Base Score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Under CVSS v2.0, it was rated with a Base Score of 7.5 (HIGH) with the vector (AV:N/AC:L/Au:N/C:P/I:P/A:P). The vulnerability was classified as CWE-190 (Integer Overflow or Wraparound) (NVD).

The integer overflow vulnerabilities in the CDF parsing implementation could lead to memory corruption issues, potentially allowing attackers to execute arbitrary code or cause denial of service conditions (Red Hat Bugzilla).

The vulnerability affects systems running file version 5.00, particularly those processing CDF files. The issue was specifically noted to impact Fedora 11 at the time of discovery (Red Hat Bugzilla).

The vulnerability was addressed with the release of file version 5.02. Users were advised to upgrade to this version to resolve the security issues. The fix was initially proposed through a patch from Apple, and subsequently incorporated into the official release (Red Hat Bugzilla).