PT-2024-4371 · Mupdf+9 · Mupdf+9

Sebras · Published 2024-02-05 · Updated 2025-11-17 · CVE-2024-24258

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions freeglut version 3.4.0 mupdf version 1.23.9

Description The issue is related to a memory leak in the glutAddSubMenu function through the menuEntry variable. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For freeglut version 3.4.0, consider disabling the glutAddSubMenu function until a patch is available to prevent potential exploitation. For mupdf version 1.23.9, restrict access to the glutAddSubMenu function to minimize the risk of exploitation.

Exploit

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALSA-2024:2366

ALSA-2024:3120

AZL-39708

AZL-43459

BDU:2024-04862

CESA-2024_3120

CVE-2024-24258

INFSA-2024_2366

INFSA-2024_3120

MGASA-2024-0165

OESA-2024-1174

RHSA-2024:2366

RHSA-2024:3120

RHSA-2024_2366

RHSA-2024_3120

RLSA-2024:2366

USN-7870-1

Affected Products

Almalinux

Centos

Debian

Linuxmint

Red Hat

Red Os

Rocky Linux

Ubuntu

Freeglut

Mupdf

References · 52

• 🔥 https://github.com/yinluming13579/mupdf_defects/blob/main/mupdf_detect_1.md · Exploit
• https://osv.dev/vulnerability/ALSA-2024:2366 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-24258 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-24258 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:3120 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-2366.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24258 · Security Note
• https://osv.dev/vulnerability/AZL-43459 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-2366.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-24258 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0165.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6IBAWX3HMMZVAWJZ3U6VOAYYOYJCN3IS · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-24258 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24259 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7870-1 · Vendor Advisory