Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.
References
| Link | Resource |
|---|---|
| https://github.com/GStreamer/orc | Product |
| https://gstreamer.freedesktop.org/modules/orc.html | Product |
| https://jvn.jp/en/jp/JVN02030803/ | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2024/07/26/1 | Third Party Advisory |
Configurations
History
27 Aug 2024, 13:52
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:gstreamer:orc:*:*:*:*:*:*:*:* | |
| CWE | CWE-787 | |
| References | () https://gstreamer.freedesktop.org/modules/orc.html - Product | |
| References | () http://www.openwall.com/lists/oss-security/2024/07/26/1 - Third Party Advisory | |
| References | () https://github.com/GStreamer/orc - Product | |
| References | () https://jvn.jp/en/jp/JVN02030803/ - Third Party Advisory | |
| First Time |
Gstreamer orc
Gstreamer |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.7 |
28 Jul 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 Jul 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-26 06:15
Updated : 2024-08-27 13:52
NVD link : CVE-2024-40897
Mitre link : CVE-2024-40897
JSON object : View
Products Affected
gstreamer
- orc
CWE
CWE-787
Out-of-bounds Write