PT-2024-10102 · Xfpt+2 · Xfpt+2

Yuhei Kawakoya · Published 2024-08-29 · Updated 2025-01-09 · CVE-2024-43700

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xfpt versions prior to 1.01

Description The issue is related to a stack-based buffer overflow vulnerability. It occurs when the software fails to handle some parameters inside the input data correctly. This can be exploited by tricking a user into processing a specially crafted file, potentially allowing arbitrary code execution on the user's environment. The vulnerability is associated with the copying of a buffer without checking the size of the input data.

Recommendations For xfpt versions prior to 1.01, consider disabling the processing of specially crafted files until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. Avoid using the vulnerable parameters inside the input data until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-120

Related Identifiers

BDU:2025-00308

CVE-2024-43700

DLA-3977-1

USN-7192-1

Affected Products

Linuxmint

Ubuntu

Xfpt

References · 21

• https://github.com/PhilipHazel/xfpt/commit/a690304bbd3fd19e9dfdad50dcc87ad829f744e4 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-43700 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00308 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-43700 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-43700 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-43700 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-43700 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-43700 · Security Note
• https://osv.dev/vulnerability/USN-7192-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3977-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7192-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-43700 · Vendor Advisory
• https://github.com/PhilipHazel/xfpt · Note
• https://jvn.jp/en/vu/JVNVU96498690 · Note
• https://twitter.com/VulmonFeeds/status/1829145782802341901 · Twitter Post