CVE-2024-40897

CVSS 7 HIGHEPSS 0.4%CWE-121

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

26 jul 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Produtos afetados

GStreamer · ORC

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/GStreamer/orc https://gstreamer.freedesktop.org/modules/orc.html https://jvn.jp/en/jp/JVN02030803/http://www.openwall.com/lists/oss-security/2024/07/26/1