CVE-2024-53849: Several stack buffer overflows and pointer overflows in editorconfig-core-c
editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53849?
CVE-2024-53849 is considered a medium severity vulnerability due to potential input validation issues leading to memory overflows.
How do I fix CVE-2024-53849?
To fix CVE-2024-53849, update the editorconfig-core package to versions 0.12.1-1.1+deb11u1 or 0.12.9+~0.15.1-1.
Who is affected by CVE-2024-53849?
CVE-2024-53849 affects users of the editorconfig-core library written in C, specifically those using vulnerable versions of the package.
What causes CVE-2024-53849?
CVE-2024-53849 is caused by several overflows that may occur in the switch case '[' when processing input patterns with excessive escaped characters.
When was CVE-2024-53849 reported?
CVE-2024-53849 was reported in 2024 and affects specific versions of the editorconfig-core software.