FG-IR-23-195: Double free with double usage of json_object_put
Published May 14, 2024
·Updated
A double free vulnerability [CWE-415] in FortiOS may allow a privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPs requests.
Affected Software
2 affected components
Fortinet FortiOS>=6.4
Fortinet FortiOS>=6.2
Event History
May 14, 2024
Advisory Published
via FortiGuard·12:00 AM
Frequently Asked Questions
1
What is the severity of FG-IR-23-195?
The FG-IR-23-195 vulnerability is considered critical due to the potential for privileged attackers to execute unauthorized code.
2
How do I fix FG-IR-23-195?
To mitigate FG-IR-23-195, update FortiOS to the latest patched version released by Fortinet.
3
Which versions of FortiOS are affected by FG-IR-23-195?
FortiOS versions 6.2 and 6.4 are vulnerable to FG-IR-23-195.
4
Who can exploit FG-IR-23-195?
A privileged attacker can exploit the FG-IR-23-195 vulnerability through specially crafted HTTP or HTTPS requests.
5
What is a double free vulnerability in the context of FG-IR-23-195?
A double free vulnerability, as referenced in FG-IR-23-195, allows a program to free a memory allocation twice, potentially leading to arbitrary code execution.