PT-2024-27094 · Zulip · Zulip

Published 2024-11-29 · Updated 2024-12-02 · CVE-2024-36612

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Zulip versions 8.0 through 8.3

Description The issue is related to a memory leak vulnerability in the handling of popovers. This vulnerability occurs in the specified versions of Zulip.

Recommendations For versions 8.0 through 8.3, update to a version that contains a fix for this memory leak vulnerability. As a temporary workaround, consider restricting the use of popovers in Zulip until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-36612

Affected Products

Zulip

References · 8

• https://github.com/zulip/zulip/commit/0a90a13becbf0338a8fc1ad37946e51c2c25b0a5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-36612 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36612 · Vendor Advisory
• https://github.com/zulip/zulip/blob/8.3/web/src/click_handlers.js · Note
• https://twitter.com/CVEnew/status/1862584921291923651 · Twitter Post
• https://gist.github.com/1047524396/f7ff51d24ebbb29e21dfb70a0c97302b · Note
• https://t.me/cvedetector/11692 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1862800949095358489 · Twitter Post