PT-2024-26089 · Unknown · Librtppayload.So

Skyh1Ll · Published 2024-10-07 · Updated 2024-10-30 · CVE-2024-34668

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions librtppayload.so versions prior to SMR Oct-2024 Release 1

Description The issue is an out-of-bounds write in parsing h.263 format, which allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this issue.

Recommendations For versions prior to SMR Oct-2024 Release 1, update to SMR Oct-2024 Release 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the librtppayload.so library until a patch is available.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-34668

Affected Products

Librtppayload.So

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-34668 · Security Note
• https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=10 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34668 · Vendor Advisory
• https://twitter.com/CVEnew/status/1843545734508954038 · Twitter Post
• https://t.me/cvedetector/7326 · Telegram Post
• https://t.me/cvenotify/97389 · Telegram Post
• https://twitter.com/cracbot/status/1845343779756310913 · Twitter Post