PT-2024-24171 · Lief+1 · Lief+1

Ld1Ng · Published 2024-05-03 · Updated 2025-08-21 · CVE-2024-31636

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LIEF version 0.14.1

Description An issue in the machd reader.c component allows a local attacker to obtain sensitive information via the name parameter.

Recommendations For LIEF version 0.14.1, consider restricting access to the name parameter in the machd reader.c component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-457

Related Identifiers

CVE-2024-31636

GHSA-377P-G8GR-5WPG

PYSEC-2024-280

Affected Products

Debian

Lief

References · 17

• 🔥 https://github.com/lief-project/LIEF/issues/1038 · Exploit
• https://osv.dev/vulnerability/GHSA-377p-g8gr-5wpg · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-31636 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31636 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-31636 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-280 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-31636 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31636 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-31636 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-31636 · Vendor Advisory
• https://github.com/lief-project/LIEF · Note
• https://github.com/lief-project/LIEF/commit/307e113f8e00b034f0a5f1baa33e54d636c52ea3 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/lief/PYSEC-2024-280.yaml · Note
• https://twitter.com/VulmonFeeds/status/1786464988053356670 · Twitter Post
• http://lief.com · Note