CVE-2024-40897

2024-07-2900:00:00

ubuntu.com

orc compiler

buffer overflow

developer environment

ci build environment

arbitrary code execution

security vulnerability

AI Score

7.8

Confidence

Low

EPSS

Percentile

5.0%

JSON

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC
versions prior to 0.4.39. If a developer is tricked to process a specially
crafted file with the affected ORC compiler, an arbitrary code may be
executed on the developer’s build environment. This may lead to compromise
of developer machines or CI build environments.

Notes

Author	Note
rodrigo-zaiden	from the security advisory: This only affects developers and CI environments using orcc, not users of liborc.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchorc< anyUNKNOWN
ubuntu20.04noarchorc< anyUNKNOWN
ubuntu22.04noarchorc< anyUNKNOWN
ubuntu24.04noarchorc< anyUNKNOWN
ubuntu16.04noarchorc< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	orc	< any	UNKNOWN
ubuntu	20.04	noarch	orc	< any	UNKNOWN
ubuntu	22.04	noarch	orc	< any	UNKNOWN
ubuntu	24.04	noarch	orc	< any	UNKNOWN
ubuntu	16.04	noarch	orc	< any	UNKNOWN