Every CVE Search/ Get API key

CVE-2007-2799

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products...

5.1 MediumFix available

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement. NOTE: this issue is due to an incorrect patch for CVE-2007-1536.

Exploit likelihood

2.70%Down 1.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.1

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement. NOTE: this issue is due to an incorrect patch for CVE-2007-1536.

Record
CVE-2007-2799
CVSS 2.0
5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement. NOTE: this issue is due to an incorrect patch for CVE-2007-1536.

Record
CVE-2007-2799
Updated
2026-11-02
EUVDEUVD-2007-2791 No score

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement. NOTE: this issue is due to an incorrect patch for CVE-2007-1536.

Record
EUVD-2007-2791
Updated
2026-11-03
GitHub AdvisoriesGHSA-g967-rw3c-p2f7 No score

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products...

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement. NOTE: this issue is due to an incorrect patch for CVE-2007-1536.

Record
GHSA-g967-rw3c-p2f7
Updated
2026-11-02
OSV No score

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement. NOTE: this issue is due to an incorrect patch for CVE-2007-1536.

Record
CVE-2007-2799
Updated
2026-11-02
OSVDEBIAN-CVE-2007-2799 No score

Integer overflow in the "file" program 4.20, when running on 32-bit systems, as used in products including The Sleuth Kit, might allow user-assisted attackers to execute arbitrary code via a large file that triggers an overflow that bypasses an assert() statement. NOTE: this issue is due to an incorrect patch for CVE-2007-1536.

Record
DEBIAN-CVE-2007-2799
Updated
2026-11-02
OSVopenSUSE-SU-2024:10755-1 No score

file-5.40-1.14 on GA media

These are all security issues fixed in the file-5.40-1.14 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10755-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
file
Debian:12
 before 4.21-1
4.21-1
file
Debian:13
 before 4.21-1
4.21-1
file
Debian:14
 before 4.21-1
4.21-1
file
Debian:3.1
 before 4.12-1sarge2, plus listed versions
4.12-14.12-1sarge1
4.12-1sarge2
file
Debian:4.0
 before 4.17-5etch2, plus listed versions
4.17-5etch1
4.17-5etch2
file
Debian:4.0
 before 4.17-5etch3, plus listed versions
4.17-5etch14.17-5etch2
4.17-5etch3
file
Red Hat:enterprise_linux:4::as
 before 0:4.10-3.0.2.el4
0:4.10-3.0.2.el4
file-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:4.10-3.0.2.el4
0:4.10-3.0.2.el4
file
Red Hat:enterprise_linux:4::desktop
 before 0:4.10-3.0.2.el4
0:4.10-3.0.2.el4
file-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:4.10-3.0.2.el4
0:4.10-3.0.2.el4
Show 9 moreShow less
Affected packages
PackageAffectedFixed
file
Red Hat:enterprise_linux:4::es
 before 0:4.10-3.0.2.el4
0:4.10-3.0.2.el4
file-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:4.10-3.0.2.el4
0:4.10-3.0.2.el4
file
Red Hat:enterprise_linux:4::ws
 before 0:4.10-3.0.2.el4
0:4.10-3.0.2.el4
file-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:4.10-3.0.2.el4
0:4.10-3.0.2.el4
file
Red Hat:enterprise_linux:5::client
 before 0:4.17-9.0.1.el5
0:4.17-9.0.1.el5
file-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:4.17-9.0.1.el5
0:4.17-9.0.1.el5
file
Red Hat:enterprise_linux:5::server
 before 0:4.17-9.0.1.el5
0:4.17-9.0.1.el5
file-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:4.17-9.0.1.el5
0:4.17-9.0.1.el5
file
openSUSE:Tumbleweed
 before 5.40-1.14
5.40-1.14

History

History
RecordedChangedSources
aliasesEUVD
affected, aliases, facts, references, titleGitHub Advisories, OSV
first indexedCVE List, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-2799 is a medium vulnerability (CVSS 5.1) in File, published May 23, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.70%, the 85th percentile. Fixed in file 4.21-1.

References

Show 42 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open