PT-2024-10101 · Unknown+4 · Editorconfig-Core-C+4

Skeeto · Published 2024-11-26 · Updated 2024-12-18 · CVE-2024-53849

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions editorconfig-core-c versions prior to 0.12.7

Description The issue is related to buffer overflows in the EditorConfig core library written in C, which can occur when the input pattern contains many escaped characters, particularly in cases of nested brackets. This can lead to the remaining input length exceeding the output capacity. The problem has been addressed in release version 0.12.7. Users are advised to upgrade to this version to resolve the issue.

Recommendations For versions prior to 0.12.7, upgrade to version 0.12.7 to resolve the issue. At the moment, there is no information about other workarounds for this vulnerability.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2025-00298

CVE-2024-53849

DLA-3978-1

GHSA-475J-WC37-6274

OPENSUSE-SU-2024_4152-1

SUSE-SU-2024:4152-1

SUSE-SU-2024_4152-1

USN-7168-1

Affected Products

Debian

Linuxmint

Suse

Ubuntu

Editorconfig-Core-C

References · 27

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53849.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2024-53849 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-3978-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7168-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0341 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53849 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-53849 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7168-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53849 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00298 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:4152-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3978-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53849 · Security Note
• https://ubuntu.com/security/CVE-2024-53849 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-53849 · Security Note