CVE-2024-40897

CVE-2024-40897 concerns the ORC library. A stack-based buffer overflow in orcparse.c affects ORC versions prior to 0.4.39, which could allow arbitrary code execution in a developer build environment when processing crafted files. The vulnerability primarily impacts developers and CI environments ...

CVE-2024-40897

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of...

CVE-2024-40897

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of...

ORC vulnerable to stack-based buffer overflow

Overview ORC provided by GStreamer is typically used when developing GStreamer plugins. Stack-based buffer overflow vulnerability CWE-121 exists in orcparse.c of ORC. Yuhei Kawakoya of NTT Security Holdings reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#02030803: ORC vulnerable to stack-based buffer overflow

ORC provided by GStreamer is typically used when developing GStreamer plugins. Stack-based buffer overflow vulnerability CWE-121 exists in orcparse.c of ORC. Impact If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on t...

PT-2024-5876 · Orc +10 · Orc +10

Name of the Vulnerable Software and Affected Versions: ORC versions prior to 0.4.39 Description: A stack-based buffer overflow vulnerability exists in the orcparse.c file of the ORC compiler. If a developer is tricked into processing a specially crafted file with the affected ORC compiler,...

GSD-2022-1007552 x86/unwind/orc: Fix unreliable stack dump with gcov

x86/unwind/orc: Fix unreliable stack dump with gcov This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.298 by commit...

GSD-2022-1007463 x86/unwind/orc: Fix unreliable stack dump with gcov

x86/unwind/orc: Fix unreliable stack dump with gcov This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.264 by commit...

GSD-2022-1007346 x86/unwind/orc: Fix unreliable stack dump with gcov

x86/unwind/orc: Fix unreliable stack dump with gcov This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.223 by commit...

GSD-2022-1006949 x86/unwind/orc: Fix unreliable stack dump with gcov

x86/unwind/orc: Fix unreliable stack dump with gcov This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.77 by commit...

GSD-2022-1006632 x86/unwind/orc: Fix unreliable stack dump with gcov

x86/unwind/orc: Fix unreliable stack dump with gcov This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.7 by commit...

PT-2022-34887 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.7 Description: The issue is related to an unreliable stack dump with gcov in the x86/unwind/orc component. The actual impact and attack plausibility have not yet been proven. Recommendations: For versions...

PT-2022-35433 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.153 Description: The issue is related to an unreliable stack dump with gcov in the x86/unwind/orc component. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2022-35718 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.264 Description: The issue is related to an unreliable stack dump with gcov in the x86/unwind/orc component. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2022-35807 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 4.14.181 through 4.14.297 Description: The issue is related to an unreliable stack dump with gcov in the x86/unwind/orc component. The actual impact and attack plausibility have not yet been proven. Recommendations: For...

Security update for nim (important)

openSUSE Security Update: Security update for nim Announcement ID: openSUSE-SU-2022:10101-1 Rating: important References: 1175332 1175333 1175334 1181705 1185083 1185084 1185085 1185948 1192712 Cross-References: CVE-2020-15690 CVE-2020-15692 CVE-2020-15693 CVE-2020-15694 CVE-2021-21372...

OPENSUSE-SU-2022:10095-1 Security update for nim

This update for nim fixes the following issues: Includes upstream security fixes for: boo1175333, CVE-2020-15693 httpClient is vulnerable to a CR-LF injection boo1175334, CVE-2020-15692 mishandle of argument to browsers.openDefaultBrowser boo1175332, CVE-2020-15694 httpClient.get.contentLength...

new packages: orc

An update is available for orc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterprise...

Apache ORC vulnerable to Uncontrolled Recursion

In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most likely denial-of-service against software that uses the ORC file parser. With the C++ parser, the stack overflow might possibly corrupt the...

GHSA-MQMP-4MCP-VG8V Apache ORC vulnerable to Uncontrolled Recursion

In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most likely denial-of-service against software that uses the ORC file parser. With the C++ parser, the stack overflow might possibly corrupt the...