Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:3920-1

Опубликовано: 06 нояб. 2024
Источник: suse-cvrf

Описание

Security update for libgsf

This update for libgsf fixes the following issues:

  • CVE-2024-42415, CVE-2024-36474: Fixed integer overflows affecting memory allocation (bsc#1231282, bsc#1231283).

Список пакетов

SUSE Linux Enterprise Module for Desktop Applications 15 SP6
libgsf-1-114-1.14.51-150600.4.3.1
SUSE Linux Enterprise Workstation Extension 15 SP6
libgsf-devel-1.14.51-150600.4.3.1
libgsf-lang-1.14.51-150600.4.3.1
typelib-1_0-Gsf-1-1.14.51-150600.4.3.1
openSUSE Leap 15.6
gsf-office-thumbnailer-1.14.51-150600.4.3.1
libgsf-1-114-1.14.51-150600.4.3.1
libgsf-devel-1.14.51-150600.4.3.1
libgsf-lang-1.14.51-150600.4.3.1
libgsf-tools-1.14.51-150600.4.3.1
typelib-1_0-Gsf-1-1.14.51-150600.4.3.1

Ссылки

Описание

An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Затронутые продукты
SUSE Linux Enterprise Module for Desktop Applications 15 SP6:libgsf-1-114-1.14.51-150600.4.3.1
SUSE Linux Enterprise Workstation Extension 15 SP6:libgsf-devel-1.14.51-150600.4.3.1
SUSE Linux Enterprise Workstation Extension 15 SP6:libgsf-lang-1.14.51-150600.4.3.1
SUSE Linux Enterprise Workstation Extension 15 SP6:typelib-1_0-Gsf-1-1.14.51-150600.4.3.1
Ссылки

Описание

An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Затронутые продукты
SUSE Linux Enterprise Module for Desktop Applications 15 SP6:libgsf-1-114-1.14.51-150600.4.3.1
SUSE Linux Enterprise Workstation Extension 15 SP6:libgsf-devel-1.14.51-150600.4.3.1
SUSE Linux Enterprise Workstation Extension 15 SP6:libgsf-lang-1.14.51-150600.4.3.1
SUSE Linux Enterprise Workstation Extension 15 SP6:typelib-1_0-Gsf-1-1.14.51-150600.4.3.1
Ссылки