|
Vulnerabilities
< Back

CVE-2024-40897

Updated on 26 Jul 2024

Severity

6.7 Medium severity

Details

CVSS score
6.7
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer’s build environment. This may lead to compromise of developer machines or CI build environments.

Details

Affected product:
AlmaLinux 9.2 ESU , CentOS 7 ELS
Affected packages:
orc @ 0.4.26 (+1 more)
Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer’s build environment. This may lead to compromise of developer machines or CI build environments.

Fixes