PT-2024-4484 · Blackberry · Qnx Sdp

Published 2024-05-13 · Updated 2025-12-01 · CVE-2024-35213

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QNX SDP versions 6.6, 7.0, and 7.1

Description The issue is related to an improper input validation vulnerability in the SGI Image Codec. This could allow an attacker to potentially cause a denial-of-service condition or execute code in the context of the image processing process by loading specially crafted SGI files. The vulnerability has been reportedly exploited in the wild.

Recommendations For QNX SDP version 6.6, update to a fixed version when available. For QNX SDP version 7.0, update to a fixed version when available. For QNX SDP version 7.1, update to a fixed version when available. As a temporary workaround, consider restricting the use of the SGI Image Codec until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-1287

CWE-20

Related Identifiers

BDU:2024-04988

CVE-2024-35213

Affected Products

Qnx Sdp

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-35213 · Security Note
• https://bdu.fstec.ru/vul/2024-04988 · Security Note
• https://support.blackberry.com/pkb/s/article/139914 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-35213 · Vendor Advisory
• https://t.me/cveNotify/144449 · Telegram Post
• https://vuldb.com/ru/?id.268066 · Note
• https://securityonline.info/cve-2024-35213-critical-vulnerability-discovered-in-blackberry-qnx-sdp · Note
• https://t.me/cvenotify/82905 · Telegram Post
• https://twitter.com/YinJai_c/status/1874828139316052301 · Twitter Post
• https://t.me/pentestingnews/48070 · Telegram Post
• https://t.me/cveNotify/134771 · Telegram Post