Описание
Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks cycle detection when traversing Mach-O binary export tries. A crafted Mach-O binary with circular references in the export trie causes unbounded queue growth and exponential string concatenation, triggering OutOfMemoryError that crashes the entire JVM and loses all unsaved work.
Ссылки
- ExploitMitigationVendor Advisory
- Third Party Advisory
- ExploitMitigationVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 10.2 (включая) до 12.1 (исключая)
cpe:2.3:a:nsa:ghidra:*:*:*:*:*:*:*:*
EPSS
Процентиль: 5%
0.00151
Низкий
5.5 Medium
CVSS3
Дефекты
CWE-835
Связанные уязвимости
CVSS3: 5.5
debian
2 месяца назад
Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption ...
EPSS
Процентиль: 5%
0.00151
Низкий
5.5 Medium
CVSS3
Дефекты
CWE-835