Bug 2300010 (CVE-2024-40897)
| Summary: | CVE-2024-40897 orc: Stack-based buffer overflow vulnerability in ORC | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | mbenatto, ndegraef |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | Flags: | ndegraef:
needinfo?
(mbenatto) |
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
Stack-based buffer overflow vulnerability exists in orcparse.c of ORC. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2300153, 2300154 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2024-07-26 06:20:13 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:5306 https://access.redhat.com/errata/RHSA-2024:5306 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2024:5629 https://access.redhat.com/errata/RHSA-2024:5629 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:5638 https://access.redhat.com/errata/RHSA-2024:5638 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2024:5882 https://access.redhat.com/errata/RHSA-2024:5882 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Telecommunications Update Service Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Via RHSA-2024:6159 https://access.redhat.com/errata/RHSA-2024:6159 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:6184 https://access.redhat.com/errata/RHSA-2024:6184 |