CVE-2024-40897

CVSS 7 HIGHEPSS 0.4%CWE-121

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

26 jul 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Productos afectados

GStreamer · ORC

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/GStreamer/orc https://gstreamer.freedesktop.org/modules/orc.html https://jvn.jp/en/jp/JVN02030803/http://www.openwall.com/lists/oss-security/2024/07/26/1