CVE-2024-0911 Indent: heap-based buffer overflow in set_buf_break()

2024-02-0614:13:40

CWE-122

fedora

github.com

cve-2024-0911

indent

c code

buffer overflow

application crash

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A flaw was found in indent, a program for formatting C code. This issue may allow an attacker to trick a user into processing a specially crafted file to trigger a heap-based buffer overflow, causing the application to crash.

CNA Affected

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "2.2.13"
      }
    ],
    "packageName": "indent",
    "collectionURL": "https://ftp.gnu.org/gnu/indent/"
  }
]