CVE-2024-30949: Integer Overflow
An issue in newlib v.4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the gettimeofday function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/newlibto a version that resolves this vulnerability.Fixed in 4.4.0.20231231-2 - Upgrade
Upgrade
debian/newlibto a version that resolves this vulnerability.Fixed in 4.5.0.20241231-1Fixed in 4.6.0.20260123-2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30949?
CVE-2024-30949 is classified as a high severity vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2024-30949?
To fix CVE-2024-30949, it is recommended to update Newlib to version 4.3.1 or later to mitigate the vulnerability.
What software versions are affected by CVE-2024-30949?
CVE-2024-30949 specifically affects Newlib version 4.3.0.
What type of vulnerability is CVE-2024-30949?
CVE-2024-30949 is an arbitrary code execution vulnerability caused by improper time unit scaling in the _gettimeofday function.
Who can be impacted by CVE-2024-30949?
Any application or system utilizing Newlib version 4.3.0 may be at risk of exploitation due to CVE-2024-30949.