CVE-2024-36474: Integer Overflow
An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libgsfto a version that resolves this vulnerability.Fixed in 1.14.50-1+deb12u1 - Upgrade
Upgrade
debian/libgsfto a version that resolves this vulnerability.Fixed in 1.14.52-1.1 - Upgrade
Upgrade
debian/libgsfto a version that resolves this vulnerability.Fixed in 1.14.50-1+deb12u1Fixed in 1.14.53-1Fixed in 1.14.53-1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36474?
CVE-2024-36474 has been classified as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2024-36474?
To fix CVE-2024-36474, upgrade to libgsf version 1.14.52-1.1 or later.
Which versions of libgsf are affected by CVE-2024-36474?
CVE-2024-36474 affects libgsf version 1.14.52 and earlier versions including 1.14.47-1 and 1.14.50-1.
What type of vulnerability is CVE-2024-36474?
CVE-2024-36474 is an integer overflow vulnerability in the Compound Document Binary File format parser.
Can CVE-2024-36474 lead to data loss?
Yes, exploitation of CVE-2024-36474 can potentially lead to data corruption or loss.