|
Lines 1-3
Link Here
|
|
|
1 |
<vuln vid="5abf3da7-9a0d-11ef-a8f0-a8a15998b5cb"> |
| 2 |
<topic>libgsf -- Arbitrary code execution</topic> |
| 3 |
<affects> |
| 4 |
<package> |
| 5 |
<name>libgsf</name> |
| 6 |
<range><eq>1.14.52</eq></range> |
| 7 |
</package> |
| 8 |
</affects> |
| 9 |
<description> |
| 10 |
<body xmlns="http://www.w3.org/1999/xhtml"> |
| 11 |
<p>talos-cna@cisco.com reports:</p> |
| 12 |
<blockquote cite="https://gitlab.gnome.org/GNOME/libgsf/-/issues/34"> |
| 13 |
<p>An integer overflow vulnerability exists in the Compound Document |
| 14 |
Binary File format parser of v1.14.52 of the GNOME Project G |
| 15 |
Structured File Library (libgsf). A specially crafted file can |
| 16 |
result in an integer overflow that allows for a heap-based buffer |
| 17 |
overflow when processing the sector allocation table. This can |
| 18 |
lead to arbitrary code execution. An attacker can provide a malicious |
| 19 |
file to trigger this vulnerability.</p> |
| 20 |
</blockquote> |
| 21 |
</body> |
| 22 |
</description> |
| 23 |
<references> |
| 24 |
<cvename>CVE-2024-42415</cvename> |
| 25 |
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-42415</url> |
| 26 |
</references> |
| 27 |
<dates> |
| 28 |
<discovery>2024-10-03</discovery> |
| 29 |
<entry>2024-11-03</entry> |
| 30 |
</dates> |
| 31 |
</vuln> |
| 32 |
|
| 33 |
<vuln vid="0fe764aa-9a0d-11ef-a8f0-a8a15998b5cb"> |
| 34 |
<topic>libgsf -- Arbitrary code execution</topic> |
| 35 |
<affects> |
| 36 |
<package> |
| 37 |
<name>libgsf</name> |
| 38 |
<range><eq>1.14.52</eq></range> |
| 39 |
</package> |
| 40 |
</affects> |
| 41 |
<description> |
| 42 |
<body xmlns="http://www.w3.org/1999/xhtml"> |
| 43 |
<p>talos-cna@cisco.com reports:</p> |
| 44 |
<blockquote cite="https://gitlab.gnome.org/GNOME/libgsf/-/issues/34"> |
| 45 |
<p>An integer overflow vulnerability exists in the Compound Document |
| 46 |
Binary File format parser of the GNOME Project G Structured File |
| 47 |
Library (libgsf) version v1.14.52. A specially crafted file can |
| 48 |
result in an integer overflow when processing the directory from |
| 49 |
the file that allows for an out-of-bounds index to be used when |
| 50 |
reading and writing to an array. This can lead to arbitrary code |
| 51 |
execution. An attacker can provide a malicious file to trigger |
| 52 |
this vulnerability.</p> |
| 53 |
</blockquote> |
| 54 |
</body> |
| 55 |
</description> |
| 56 |
<references> |
| 57 |
<cvename>CVE-2024-36474</cvename> |
| 58 |
<url>https://nvd.nist.gov/vuln/detail/CVE-2024-36474</url> |
| 59 |
</references> |
| 60 |
<dates> |
| 61 |
<discovery>2024-10-03</discovery> |
| 62 |
<entry>2024-11-03</entry> |
| 63 |
</dates> |
| 64 |
</vuln> |
| 65 |
|
| 1 |
<vuln vid="e17384ef-c5e8-4b5d-bb62-c13405e7f1f7"> |
66 |
<vuln vid="e17384ef-c5e8-4b5d-bb62-c13405e7f1f7"> |
| 2 |
<topic>chromium -- multiple security fixes</topic> |
67 |
<topic>chromium -- multiple security fixes</topic> |
| 3 |
<affects> |
68 |
<affects> |
| 4 |
- |
|
|