CVE-2015-8865

What it actually does

Mishandled continuation-level jumps in file_check_mem allow a crafted magic file to trigger buffer overflow, enabling denial of service via application crash or potential arbitrary code execution in affected file and PHP Fileinfo components.

Why it matters to the business

Systems processing untrusted files may experience crashes or remote code execution, leading to service outages, data exposure, or full host compromise; older packages remain exposed years after disclosure despite available fixes.

How an attack unfolds

An attacker crafts a malicious magic file exploiting jump mishandling, then supplies it to an application using the vulnerable file library or PHP Fileinfo (such as through file uploads or command-line processing) to trigger overflow and gain code execution or crash the process.

How to fix it

Upgrade affected chicken packages on Debian 11/12/13 and Ubuntu 18.04 LTS to the listed fixed versions (4.12.0-0.2 or 4.12.0-0.3) and rebuild/restart dependent services; replace or isolate any remaining older file/PHP Fileinfo instances.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases; test file command and PHP Fileinfo against known-good and crafted magic files to confirm absence of overflow behavior.

Typical attack path

1. Identify application or service that invokes file or PHP Fileinfo on user-supplied files
2. Craft magic file triggering continuation-level jump mishandling
3. Deliver crafted file via upload, email attachment, or command-line invocation
4. Trigger processing to cause buffer overflow
5. Achieve denial of service or execute arbitrary code

How to detect it

Review application and system logs for unexpected crashes or segmentation faults during file or PHP Fileinfo processing of external files; inspect process dumps or core files for signs of buffer overflow when handling magic databases.

What your security team should do

• Immediately upgrade chicken and dependent file/PHP packages to fixed versions
• Scan environments for legacy file < 5.23 or PHP < 5.5.34/5.6.20/7.0.5 usage
• Implement file-type validation and sandboxing for untrusted file processing
• Monitor EPSS and exploit availability trends for any renewed interest