Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:3922-1

Опубликовано: 06 нояб. 2024
Источник: suse-cvrf

Описание

Security update for libgsf

This update for libgsf fixes the following issues:

  • CVE-2024-42415, CVE-2024-36474: Fixed integer overflows affecting memory allocation (bsc#1231282, bsc#1231283).

Список пакетов

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
libgsf-1-114-1.14.50-150400.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
libgsf-1-114-1.14.50-150400.3.6.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP5
libgsf-1-114-1.14.50-150400.3.6.1
SUSE Linux Enterprise Server 15 SP4-LTSS
libgsf-1-114-1.14.50-150400.3.6.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4
libgsf-1-114-1.14.50-150400.3.6.1
SUSE Linux Enterprise Workstation Extension 15 SP5
libgsf-devel-1.14.50-150400.3.6.1
libgsf-lang-1.14.50-150400.3.6.1
typelib-1_0-Gsf-1-1.14.50-150400.3.6.1
openSUSE Leap 15.5
gsf-office-thumbnailer-1.14.50-150400.3.6.1
libgsf-1-114-1.14.50-150400.3.6.1
libgsf-1-114-32bit-1.14.50-150400.3.6.1
libgsf-devel-1.14.50-150400.3.6.1
libgsf-lang-1.14.50-150400.3.6.1
libgsf-tools-1.14.50-150400.3.6.1
typelib-1_0-Gsf-1-1.14.50-150400.3.6.1

Ссылки

Описание

An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libgsf-1-114-1.14.50-150400.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libgsf-1-114-1.14.50-150400.3.6.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libgsf-1-114-1.14.50-150400.3.6.1
SUSE Linux Enterprise Server 15 SP4-LTSS:libgsf-1-114-1.14.50-150400.3.6.1
Ссылки

Описание

An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libgsf-1-114-1.14.50-150400.3.6.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libgsf-1-114-1.14.50-150400.3.6.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libgsf-1-114-1.14.50-150400.3.6.1
SUSE Linux Enterprise Server 15 SP4-LTSS:libgsf-1-114-1.14.50-150400.3.6.1
Ссылки