PT-2024-4372 · Mupdf+9 · Mupdf+9

Sebras · Published 2024-02-05 · Updated 2025-11-17 · CVE-2024-24259

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions freeglut versions 3.4.0 and earlier mupdf version 1.23.9

Description The issue is related to a memory leak via the menuEntry variable in the glutAddMenuEntry() function. This can potentially allow a remote attacker to cause a denial of service.

Recommendations For freeglut versions 3.4.0 and earlier, consider disabling the glutAddMenuEntry() function until a patch is available. For mupdf version 1.23.9, restrict access to the glutAddMenuEntry() function to minimize the risk of exploitation. Avoid using the menuEntry variable in the affected function until the issue is resolved.

Exploit

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALSA-2024:2366

ALSA-2024:3120

AZL-39694

AZL-43438

BDU:2024-04863

CESA-2024_3120

CVE-2024-24259

INFSA-2024_2366

INFSA-2024_3120

MGASA-2024-0165

OESA-2024-1174

RHSA-2024:2366

RHSA-2024:3120

RHSA-2024_2366

RHSA-2024_3120

RLSA-2024:2366

USN-7870-1

Affected Products

Almalinux

Centos

Debian

Linuxmint

Red Hat

Red Os

Rocky Linux

Ubuntu

Freeglut

Mupdf

References · 52

• 🔥 https://github.com/yinluming13579/mupdf_defects/blob/main/mupdf_detect_2.md · Exploit
• https://bdu.fstec.ru/vul/2024-04863 · Security Note
• https://osv.dev/vulnerability/ALSA-2024:2366 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-24259 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:3120 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-2366.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-24259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24258 · Security Note
• https://osv.dev/vulnerability/AZL-43438 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-2366.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-24259 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6IBAWX3HMMZVAWJZ3U6VOAYYOYJCN3IS · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0165.html · Security Note
• https://osv.dev/vulnerability/CVE-2024-24259 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7870-1 · Vendor Advisory