PT-2024-7266 · Gnome+6 · Libgsf+6

A Member · Published 2024-09-03 · Updated 2024-11-23 · CVE-2024-36474

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GNOME Project G Structured File Library (libgsf) version v1.14.52

Description: An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow when processing the directory from the file, allowing for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Recommendations: For GNOME Project G Structured File Library (libgsf) version v1.14.52, update to a version that fixes the integer overflow vulnerability in the Compound Document Binary File format parser. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2024-15101

AZL-50064

AZL-50097

BDU:2024-08615

CVE-2024-36474

DLA-3911-1

DSA-5786-1

MGASA-2024-0337

OESA-2024-2221

OPENSUSE-SU-2024_3920-1

OPENSUSE-SU-2024_3922-1

SUSE-SU-2024:3770-1

SUSE-SU-2024:3920-1

SUSE-SU-2024:3921-1

SUSE-SU-2024:3922-1

SUSE-SU-2024_3920-1

SUSE-SU-2024_3921-1

SUSE-SU-2024_3922-1

USN-7062-1

USN-7062-2

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Os

Suse

Ubuntu

Libgsf

References · 57

• https://osv.dev/vulnerability/DEBIAN-CVE-2024-36474 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3921-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-36474 · Security Note
• https://ubuntu.com/security/CVE-2024-42415 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-50064 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3922-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3911-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-36474 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-36474 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5786-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-50097 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36474 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3770-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7062-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2221 · Vendor Advisory