Описание
A flaw was found in the libgsf package, affecting the sorting_key_copy function. It is possible to launch the attack on the local host, and manipulation of the Name argument can lead to out-of-bounds read.
Отчет
This CVE has been marked as Rejected by the assigning CNA. The code maintainer explains that "the only way to get an object of type GsfMSOleSortingKey is via gsf_msole_sorting_key_new which adds that extra zero element".
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | libgsf | Fix deferred | ||
| Red Hat Enterprise Linux 6 | libgsf | Fix deferred | ||
| Red Hat Enterprise Linux 7 | libgsf | Fix deferred | ||
| Red Hat Enterprise Linux 8 | libgsf | Fix deferred | ||
| Red Hat Enterprise Linux 9 | libgsf | Fix deferred |
Показывать по
Дополнительная информация
3.3 Low
CVSS3
Связанные уязвимости
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The code maintainer explains that "the only way to get an object of type GsfMSOleSortingKey is via gsf_msole_sorting_key_new which adds that extra zero element".
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The code maintainer explains that "the only way to get an object of type GsfMSOleSortingKey is via gsf_msole_sorting_key_new which adds that extra zero element".
A vulnerability classified as problematic has been found in GNOME libgsf up to 1.14.53. Affected is the function sorting_key_copy. The manipulation of the argument Name leads to out-of-bounds read. It is possible to launch the attack on the local host. The vendor was contacted early about this disclosure but did not respond in any way.
Уязвимость функции sorting_key_copy библиотеки структурированных файлов The GNOME Project libgsf, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации
3.3 Low
CVSS3