CVE-2024-30949

2024-08-2015:15:20

Debian Security Bug Tracker

security-tracker.debian.org

newlib vulnerability time-scaling arbitrary-code-execution unix

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

Low

EPSS

0.001

Percentile

28.0%

JSON

An issue in newlib v.4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the _gettimeofday function.

OSVersionArchitecturePackageVersionFilename
Debian12allnewlib<= 3.3.0-1.3+deb12u1newlib_3.3.0-1.3+deb12u1_all.deb
Debian11allnewlib<= 3.3.0-1newlib_3.3.0-1_all.deb
Debian999allnewlib< 4.4.0.20231231-2newlib_4.4.0.20231231-2_all.deb
Debian13allnewlib< 4.4.0.20231231-2newlib_4.4.0.20231231-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	newlib	<= 3.3.0-1.3+deb12u1	newlib_3.3.0-1.3+deb12u1_all.deb
Debian	11	all	newlib	<= 3.3.0-1	newlib_3.3.0-1_all.deb
Debian	999	all	newlib	< 4.4.0.20231231-2	newlib_4.4.0.20231231-2_all.deb
Debian	13	all	newlib	< 4.4.0.20231231-2	newlib_4.4.0.20231231-2_all.deb