PT-2024-19960 · Libbiosig+1 · Libbiosig+1

Lilith >_> · Published 2024-02-20 · Updated 2025-01-22 · CVE-2024-23606

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libbiosig version 2.5.0 libbiosig Master Branch (ab0ee111)

Description An out-of-bounds write issue exists in the sopen FAMOS read functionality. A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this issue.

Recommendations For libbiosig version 2.5.0, consider disabling the sopen FAMOS read functionality until a patch is available. For libbiosig Master Branch (ab0ee111), restrict the use of the sopen FAMOS read functionality to minimize the risk of exploitation. Avoid using malicious .famos files in the affected functionality until the issue is resolved.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

CWE-131

Related Identifiers

CVE-2024-23606

Affected Products

Debian

Libbiosig

References · 14

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1925 · Exploit
• https://osv.dev/vulnerability/CVE-2024-23606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23606 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-23606 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-23606 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-23606 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-23606 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-23606 · Security Note
• https://t.me/cvenotify/71997 · Telegram Post
• https://t.me/cvenotify/108204 · Telegram Post
• https://twitter.com/cracbot/status/1760182646787977698 · Twitter Post
• https://twitter.com/CVEnew/status/1759969334548697245 · Twitter Post
• https://sourceforge.net/p/biosig/code/ci/e20e81564f0709323f7b99486a0a2b4594ab05f2 · Note