PT-2024-14384 · Unknown · Jfreechart

Published 2024-04-10 · Updated 2024-08-16 · CVE-2023-52070

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JFreeChart version 1.5.4

Description The issue is related to an ArrayIndexOutOfBounds condition via the setSeriesNeedle(int index, int type) method. However, it is noted that the existence of this issue is disputed by multiple third parties, suggesting that the evidence may not be sufficient to confirm the vulnerability.

Recommendations For JFreeChart version 1.5.4, as a temporary workaround, consider restricting the use of the setSeriesNeedle(int index, int type) method until further clarification on the issue is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2023-52070

Affected Products

Jfreechart

References · 10

• https://ubuntu.com/security/CVE-2023-52070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52070 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-52070 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-52070 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52070 · Vendor Advisory
• https://t.me/cvenotify/90919 · Telegram Post
• http://jfreechart.com · Note
• http://jfreeorg.com · Note
• https://gist.github.com/LLM4IG/f55de46e65fb5a19b7815adb36fd858b · Note
• https://twitter.com/VulmonFeeds/status/1778177249885216882 · Twitter Post