Release Date: | 2024-07-26 | |
Impact: | Moderate | What is this? |
Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.
See more information about CVE-2024-40897 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS metrics and score provided are preliminary and subject to review.
Base Score: | 7.3 |
Vector String: | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Version: | 3.1 |
Attack Vector: | Local |
Attack Complexity: | Low |
Privileges Required: | Low |
User Interaction: | Required |
Scope: | Unchanged |
Confidentiality Impact: | High |
Integrity Impact: | High |
Availability Impact: | High |
Platform | Errata | Release Date |
Oracle Linux version 8 (orc) | ELSA-2024-5306 | 2024-08-13 |
Oracle Linux version 9 (orc) | ELSA-2024-6184 | 2024-09-03 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections: