Описание
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
An integer overflow vulnerability was found in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Отчет
This vulnerability is classified as important severity rather than moderate due to its potential for arbitrary code execution, which poses a serious security risk. The integer overflow in the sector allocation table leads to a heap-based buffer overflow, allowing an attacker to write beyond the allocated memory bounds. Exploiting this flaw can result in memory corruption, enabling attackers to execute arbitrary code with the privileges of the affected application. Given that the vulnerability can be triggered by merely opening a specially crafted file, this expands the attack surface significantly, making exploitation feasible even through routine user actions like opening documents.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libgsf | Not affected | ||
| Red Hat Enterprise Linux 7 | libgsf | Not affected | ||
| Red Hat Enterprise Linux 8 | libgsf | Not affected | ||
| Red Hat Enterprise Linux 9 | libgsf | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.4 High
CVSS3
Связанные уязвимости
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
An integer overflow vulnerability exists in the Compound Document Bina ...
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Уязвимость библиотеки структурированных файлов The GNOME Project libgsf, связанная с переполнением целых чисел на основе динамической памяти, позволяющая нарушителю выполнить произвольный код
EPSS
8.4 High
CVSS3