CVE-2024-43700

CVSS 7 HIGHEPSS 0.3%CWE-120

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

29 ago 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Productos afectados

Philip Hazel · xfpt

Referencias

https://github.com/PhilipHazel/xfpt https://github.com/PhilipHazel/xfpt/commit/a690304bbd3fd19e9dfdad50dcc87ad829f744e4 https://jvn.jp/en/vu/JVNVU96498690/https://lists.debian.org/debian-lts-announce/2024/11/msg00034.html