Common Weakness Enumeration
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Show details on NVD website
Back to CWE stats page
CWE-125
Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
CVE-2024-5512 (GCVE-0-2024-5512)
Vulnerability from cvelistv5 – Published: 2024-11-22 20:05 – Updated: 2024-11-23 01:26
VLAI
Title
Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Summary
Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22021.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
Date Public
2024-05-31 19:15
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5512",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-23T01:20:45.826917Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-23T01:26:29.221Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Power PDF",
"vendor": "Kofax",
"versions": [
{
"status": "affected",
"version": "5.0.0.57 (5.0.0.10.0.23307)"
}
]
}
],
"dateAssigned": "2024-05-29T21:53:08.528Z",
"datePublic": "2024-05-31T19:15:58.804Z",
"descriptions": [
{
"lang": "en",
"value": "Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22021."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-22T20:05:23.526Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-555",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-555/"
}
],
"source": {
"lang": "en",
"value": "Mat Powell of Trend Micro Zero Day Initiative"
},
"title": "Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-5512",
"datePublished": "2024-11-22T20:05:23.526Z",
"dateReserved": "2024-05-29T21:53:08.502Z",
"dateUpdated": "2024-11-23T01:26:29.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5535 (GCVE-0-2024-5535)
Vulnerability from cvelistv5 – Published: 2024-06-27 10:30 – Updated: 2026-05-12 11:35
VLAI
Title
SSL_select_next_proto buffer overread
Summary
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an
empty supported client protocols buffer may cause a crash or memory contents to
be sent to the peer.
Impact summary: A buffer overread can have a range of potential consequences
such as unexpected application beahviour or a crash. In particular this issue
could result in up to 255 bytes of arbitrary private data from memory being sent
to the peer leading to a loss of confidentiality. However, only applications
that directly call the SSL_select_next_proto function with a 0 length list of
supported client protocols are affected by this issue. This would normally never
be a valid scenario and is typically not under attacker control but may occur by
accident in the case of a configuration or programming error in the calling
application.
The OpenSSL API function SSL_select_next_proto is typically used by TLS
applications that support ALPN (Application Layer Protocol Negotiation) or NPN
(Next Protocol Negotiation). NPN is older, was never standardised and
is deprecated in favour of ALPN. We believe that ALPN is significantly more
widely deployed than NPN. The SSL_select_next_proto function accepts a list of
protocols from the server and a list of protocols from the client and returns
the first protocol that appears in the server list that also appears in the
client list. In the case of no overlap between the two lists it returns the
first item in the client list. In either case it will signal whether an overlap
between the two lists was found. In the case where SSL_select_next_proto is
called with a zero length client list it fails to notice this condition and
returns the memory immediately following the client list pointer (and reports
that there was no overlap in the lists).
This function is typically called from a server side application callback for
ALPN or a client side application callback for NPN. In the case of ALPN the list
of protocols supplied by the client is guaranteed by libssl to never be zero in
length. The list of server protocols comes from the application and should never
normally be expected to be of zero length. In this case if the
SSL_select_next_proto function has been called as expected (with the list
supplied by the client passed in the client/client_len parameters), then the
application will not be vulnerable to this issue. If the application has
accidentally been configured with a zero length server list, and has
accidentally passed that zero length server list in the client/client_len
parameters, and has additionally failed to correctly handle a "no overlap"
response (which would normally result in a handshake failure in ALPN) then it
will be vulnerable to this problem.
In the case of NPN, the protocol permits the client to opportunistically select
a protocol when there is no overlap. OpenSSL returns the first client protocol
in the no overlap case in support of this. The list of client protocols comes
from the application and should never normally be expected to be of zero length.
However if the SSL_select_next_proto function is accidentally called with a
client_len of 0 then an invalid memory pointer will be returned instead. If the
application uses this output as the opportunistic protocol then the loss of
confidentiality will occur.
This issue has been assessed as Low severity because applications are most
likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not
widely used. It also requires an application configuration or programming error.
Finally, this issue would not typically be under attacker control making active
exploitation unlikely.
The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
Due to the low severity of this issue we are not issuing new releases of
OpenSSL at this time. The fix will be included in the next releases when they
become available.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
21 references
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| OpenSSL | OpenSSL |
Affected:
3.3.0 , < 3.3.2
(semver)
Affected: 3.2.0 , < 3.2.3 (semver) Affected: 3.1.0 , < 3.1.7 (semver) Affected: 3.0.0 , < 3.0.15 (semver) Affected: 1.1.1 , < 1.1.1za (custom) Affected: 1.0.2 , < 1.0.2zk (custom) |
|
| openssl | openssl |
Affected:
3.3.0 , < 3.3.2
(custom)
Affected: 3.2.0 , < 3.2.3 (custom) Affected: 3.1.0 , < 3.1.7 (custom) Affected: 3.0.0 , < 3.0.15 (custom) Affected: 1.1.1 , < 1.1.1za (custom) Affected: 1.0.2 , < 1.0.2zk (custom) cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
|
| Siemens | RUGGEDCOM RST2428P |
Affected:
0 , < V3.1
(custom)
|
|
| Siemens | SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family |
Unaffected:
0 , < *
(custom)
|
|
| Siemens | SCALANCE XCM-/XRM-/XCH-/XRH-300 family |
Affected:
0 , < V3.1
(custom)
|
|
| Siemens | SIDIS Prime |
Affected:
0 , < V4.0.700
(custom)
|
|
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem |
Affected:
0 , < *
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.0 , < V3.1.5
(custom)
|
|
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
Affected:
V3.1.0 , < V3.1.5
(custom)
|
|
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
Affected:
V3.1.0 , < V3.1.5
(custom)
|
Date Public
2024-06-26 23:00
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "openssl",
"vendor": "openssl",
"versions": [
{
"lessThan": "3.3.2",
"status": "affected",
"version": "3.3.0",
"versionType": "custom"
},
{
"lessThan": "3.2.3",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.1.7",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.0.15",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "1.1.1za",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
},
{
"lessThan": "1.0.2zk",
"status": "affected",
"version": "1.0.2",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-5535",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-14T04:55:17.007Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:32:30.900Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "OpenSSL Advisory",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.openssl.org/news/secadv/20240627.txt"
},
{
"name": "3.3.2 git commit",
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c"
},
{
"name": "3.2.3 git commit",
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e"
},
{
"name": "3.1.7 git commit",
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37"
},
{
"name": "3.0.15 git commit",
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c"
},
{
"name": "1.1.1za git commit",
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87"
},
{
"name": "1.0.2zk git commit",
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/06/27/1"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/06/28/4"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20240712-0005/"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/08/15/1"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
},
{
"url": "https://security.netapp.com/advisory/ntap-20241025-0010/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2428P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIDIS Prime",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.0.700",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.1.5",
"status": "affected",
"version": "V3.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.1.5",
"status": "affected",
"version": "V3.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.1.5",
"status": "affected",
"version": "V3.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.1.5",
"status": "affected",
"version": "V3.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.1.5",
"status": "affected",
"version": "V3.1.0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T11:35:07.079Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-277137.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenSSL",
"vendor": "OpenSSL",
"versions": [
{
"lessThan": "3.3.2",
"status": "affected",
"version": "3.3.0",
"versionType": "semver"
},
{
"lessThan": "3.2.3",
"status": "affected",
"version": "3.2.0",
"versionType": "semver"
},
{
"lessThan": "3.1.7",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
},
{
"lessThan": "3.0.15",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
},
{
"lessThan": "1.1.1za",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
},
{
"lessThan": "1.0.2zk",
"status": "affected",
"version": "1.0.2",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joseph Birr-Pixton"
},
{
"lang": "en",
"type": "analyst",
"value": "David Benjamin (Google)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Matt Caswell"
}
],
"datePublic": "2024-06-26T23:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\u003cbr\u003eempty supported client protocols buffer may cause a crash or memory contents to\u003cbr\u003ebe sent to the peer.\u003cbr\u003e\u003cbr\u003eImpact summary: A buffer overread can have a range of potential consequences\u003cbr\u003esuch as unexpected application beahviour or a crash. In particular this issue\u003cbr\u003ecould result in up to 255 bytes of arbitrary private data from memory being sent\u003cbr\u003eto the peer leading to a loss of confidentiality. However, only applications\u003cbr\u003ethat directly call the SSL_select_next_proto function with a 0 length list of\u003cbr\u003esupported client protocols are affected by this issue. This would normally never\u003cbr\u003ebe a valid scenario and is typically not under attacker control but may occur by\u003cbr\u003eaccident in the case of a configuration or programming error in the calling\u003cbr\u003eapplication.\u003cbr\u003e\u003cbr\u003eThe OpenSSL API function SSL_select_next_proto is typically used by TLS\u003cbr\u003eapplications that support ALPN (Application Layer Protocol Negotiation) or NPN\u003cbr\u003e(Next Protocol Negotiation). NPN is older, was never standardised and\u003cbr\u003eis deprecated in favour of ALPN. We believe that ALPN is significantly more\u003cbr\u003ewidely deployed than NPN. The SSL_select_next_proto function accepts a list of\u003cbr\u003eprotocols from the server and a list of protocols from the client and returns\u003cbr\u003ethe first protocol that appears in the server list that also appears in the\u003cbr\u003eclient list. In the case of no overlap between the two lists it returns the\u003cbr\u003efirst item in the client list. In either case it will signal whether an overlap\u003cbr\u003ebetween the two lists was found. In the case where SSL_select_next_proto is\u003cbr\u003ecalled with a zero length client list it fails to notice this condition and\u003cbr\u003ereturns the memory immediately following the client list pointer (and reports\u003cbr\u003ethat there was no overlap in the lists).\u003cbr\u003e\u003cbr\u003eThis function is typically called from a server side application callback for\u003cbr\u003eALPN or a client side application callback for NPN. In the case of ALPN the list\u003cbr\u003eof protocols supplied by the client is guaranteed by libssl to never be zero in\u003cbr\u003elength. The list of server protocols comes from the application and should never\u003cbr\u003enormally be expected to be of zero length. In this case if the\u003cbr\u003eSSL_select_next_proto function has been called as expected (with the list\u003cbr\u003esupplied by the client passed in the client/client_len parameters), then the\u003cbr\u003eapplication will not be vulnerable to this issue. If the application has\u003cbr\u003eaccidentally been configured with a zero length server list, and has\u003cbr\u003eaccidentally passed that zero length server list in the client/client_len\u003cbr\u003eparameters, and has additionally failed to correctly handle a \"no overlap\"\u003cbr\u003eresponse (which would normally result in a handshake failure in ALPN) then it\u003cbr\u003ewill be vulnerable to this problem.\u003cbr\u003e\u003cbr\u003eIn the case of NPN, the protocol permits the client to opportunistically select\u003cbr\u003ea protocol when there is no overlap. OpenSSL returns the first client protocol\u003cbr\u003ein the no overlap case in support of this. The list of client protocols comes\u003cbr\u003efrom the application and should never normally be expected to be of zero length.\u003cbr\u003eHowever if the SSL_select_next_proto function is accidentally called with a\u003cbr\u003eclient_len of 0 then an invalid memory pointer will be returned instead. If the\u003cbr\u003eapplication uses this output as the opportunistic protocol then the loss of\u003cbr\u003econfidentiality will occur.\u003cbr\u003e\u003cbr\u003eThis issue has been assessed as Low severity because applications are most\u003cbr\u003elikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\u003cbr\u003ewidely used. It also requires an application configuration or programming error.\u003cbr\u003eFinally, this issue would not typically be under attacker control making active\u003cbr\u003eexploitation unlikely.\u003cbr\u003e\u003cbr\u003eThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\u003cbr\u003e\u003cbr\u003e\n\nDue to the low severity of this issue we are not issuing new releases of\u003cbr\u003eOpenSSL at this time. The fix will be included in the next releases when they\u003cbr\u003ebecome available."
}
],
"value": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available."
}
],
"metrics": [
{
"format": "other",
"other": {
"content": {
"text": "Low"
},
"type": "https://www.openssl.org/policies/secpolicy.html"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-01T08:29:27.594Z",
"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"shortName": "openssl"
},
"references": [
{
"name": "OpenSSL Advisory",
"tags": [
"vendor-advisory"
],
"url": "https://www.openssl.org/news/secadv/20240627.txt"
},
{
"name": "3.3.2 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c"
},
{
"name": "3.2.3 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e"
},
{
"name": "3.1.7 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37"
},
{
"name": "3.0.15 git commit",
"tags": [
"patch"
],
"url": "https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c"
},
{
"name": "1.1.1za git commit",
"tags": [
"patch"
],
"url": "https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87"
},
{
"name": "1.0.2zk git commit",
"tags": [
"patch"
],
"url": "https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "SSL_select_next_proto buffer overread",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
"assignerShortName": "openssl",
"cveId": "CVE-2024-5535",
"datePublished": "2024-06-27T10:30:53.118Z",
"dateReserved": "2024-05-30T15:34:36.813Z",
"dateUpdated": "2026-05-12T11:35:07.079Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-5560 (GCVE-0-2024-5560)
Vulnerability from cvelistv5 – Published: 2024-06-12 16:45 – Updated: 2024-08-01 21:18
VLAI
Summary
CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the
device’s web interface when an attacker sends a specially crafted HTTP request.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Schneider Electric | Sage 1410 |
Affected:
Versions C3414-500-S02K5_P8 and prior
|
|
| Schneider Electric | Sage 1430 |
Affected:
Versions C3414-500-S02K5_P8 and prior
|
|
| Schneider Electric | Sage 1450 |
Affected:
Versions C3414-500-S02K5_P8 and prior
|
|
| Schneider Electric | Sage 2400 |
Affected:
Versions C3414-500-S02K5_P8 and prior
|
|
| Schneider Electric | Sage 3030 Magnum |
Affected:
Versions C3414-500-S02K5_P8 and prior
|
|
| Schneider Electric | Sage 4400 |
Affected:
Versions C3414-500-S02K5_P8 and prior
|
|
| schneider-electric | sage_4400 |
Affected:
0 , ≤ c3414-500-s02k5_p8
(custom)
cpe:2.3:h:schneider-electric:sage_3030_magnum:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:sage_1410:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:sage_1430:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:sage_1450:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:sage_2400:-:*:*:*:*:*:*:* cpe:2.3:h:schneider-electric:sage_4400:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:schneider-electric:sage_3030_magnum:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1410:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1430:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1450:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_2400:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_4400:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sage_4400",
"vendor": "schneider-electric",
"versions": [
{
"lessThanOrEqual": "c3414-500-s02k5_p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T18:30:24.462387Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T18:32:10.472Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:18:06.538Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sage 1410",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1430",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1450",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 2400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 3030 Magnum",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 4400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nCWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the\ndevice\u2019s web interface when an attacker sends a specially crafted HTTP request.\n\n"
}
],
"value": "CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the\ndevice\u2019s web interface when an attacker sends a specially crafted HTTP request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T16:45:56.256Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-5560",
"datePublished": "2024-06-12T16:45:56.256Z",
"dateReserved": "2024-05-31T06:58:55.638Z",
"dateUpdated": "2024-08-01T21:18:06.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5629 (GCVE-0-2024-5629)
Vulnerability from cvelistv5 – Published: 2024-06-05 14:32 – Updated: 2025-02-13 17:54
VLAI
Title
Out-of-bounds read in bson module of PyMongo
Summary
An out-of-bounds read in the 'bson' module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB Inc | PyMongo |
Affected:
0 , ≤ 4.6.2
(custom)
cpe:2.3:a:mongodb:python_driver:0.4:pre:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.5:pre:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.5.1:pre:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.5.2:pre:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.5.3:pre:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.6:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.7:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.7.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.7.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.8:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.8.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.9:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.9.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.9.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.9.3:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.9.4:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.9.5:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.10.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.10.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.10.3:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.11:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.11.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.11.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.11.3:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.12:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.13:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.14:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.14.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.14.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.15:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.15.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.15.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:0.16:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.1.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.1.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.2.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.3:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.4:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.5:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.5.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.5.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.6:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.7:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.8:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.8.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.9:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.10.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:1.11:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.0.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.1.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.2:-:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.2:rc1:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.2.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.3:-:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.3:rc1:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.4:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.4.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.4.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.5:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.5.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.5.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.6:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.6.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.6.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.6.3:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.7:-:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.7:rc0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.7:rc1:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.7.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.7.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.8:-:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.8:rc0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.8:rc1:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.8:rc2:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.8.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.9:-:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.9:rc0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.9.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.9.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.9.3:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.9.4:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:2.9.5:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3:-:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3:b0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3:b1:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3:rc0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3:rc1:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.0.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.0.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.0.3:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.1:-:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.1:rc0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.1.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.2:-:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.2:rc0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.2.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.2.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.3.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.3.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.4:rc0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.4.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.5.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.5.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.6:rc0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.6.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.6.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.7.0:-:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.7.0:b0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.7.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.7.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.8.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.9.0:-:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.9.0:b0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.9.0:b1:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.10.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.10.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.11.0:-:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.11.0:b0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.11.0:b1:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.11.0:rc0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.11.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.11.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.11.3:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.11.4:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.12.0:b0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.12.0:b1:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.12.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.12.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.12.3:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:3.13.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.0.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.0.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.0.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.1.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.1.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.2.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.3.2:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.3.3:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.4.0:b0:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.4.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.4.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.5.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.6.0:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.6.1:*:*:*:*:mongodb:*:* cpe:2.3:a:mongodb:python_driver:4.6.2:*:*:*:*:mongodb:*:* |
Date Public
2024-06-05 14:32
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5629",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-05T20:52:39.427569Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-05T20:52:59.238Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-09-16T23:02:28.936Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"release-notes",
"x_transferred"
],
"url": "https://jira.mongodb.org/browse/PYTHON-4305"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00007.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00032.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mongodb:python_driver:0.4:pre:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.5:pre:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.5.1:pre:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.5.2:pre:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.5.3:pre:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.6:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.7:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.7.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.7.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.8:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.8.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.9:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.9.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.9.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.9.3:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.9.4:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.9.5:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.10.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.10.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.10.3:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.11:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.11.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.11.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.11.3:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.12:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.13:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.14:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.14.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.14.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.15:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.15.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.15.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:0.16:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.1.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.1.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.2.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.3:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.4:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.5:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.5.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.5.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.6:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.7:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.8:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.8.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.9:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.10.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:1.11:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.0.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.1.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.2:-:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.2:rc1:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.2.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.3:-:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.3:rc1:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.4:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.4.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.4.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.5:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.5.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.5.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.6:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.6.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.6.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.6.3:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.7:-:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.7:rc0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.7:rc1:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.7.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.7.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.8:-:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.8:rc0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.8:rc1:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.8:rc2:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.8.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.9:-:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.9:rc0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.9.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.9.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.9.3:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.9.4:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:2.9.5:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3:-:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3:b0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3:b1:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3:rc0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3:rc1:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.0.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.0.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.0.3:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.1:-:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.1:rc0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.1.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.2:-:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.2:rc0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.2.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.2.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.3.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.3.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.4:rc0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.4.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.5.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.5.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.6:rc0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.6.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.6.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.7.0:-:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.7.0:b0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.7.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.7.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.8.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.9.0:-:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.9.0:b0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.9.0:b1:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.10.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.10.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.11.0:-:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.11.0:b0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.11.0:b1:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.11.0:rc0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.11.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.11.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.11.3:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.11.4:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.12.0:b0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.12.0:b1:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.12.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.12.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.12.3:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:3.13.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.0.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.0.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.0.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.1.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.1.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.2.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.3.2:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.3.3:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.4.0:b0:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.4.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.4.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.5.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.6.0:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.6.1:*:*:*:*:mongodb:*:*",
"cpe:2.3:a:mongodb:python_driver:4.6.2:*:*:*:*:mongodb:*:*"
],
"defaultStatus": "unaffected",
"product": "PyMongo",
"vendor": "MongoDB Inc",
"versions": [
{
"lessThanOrEqual": "4.6.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-06-05T14:32:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn out-of-bounds read in the \u0027bson\u0027 module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "An out-of-bounds read in the \u0027bson\u0027 module of PyMongo 4.6.2 or earlier allows deserialization of malformed BSON provided by a Server to raise an exception which may contain arbitrary application memory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-17T13:05:51.315Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://jira.mongodb.org/browse/PYTHON-4305"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00007.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Out-of-bounds read in bson module of PyMongo",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2024-5629",
"datePublished": "2024-06-05T14:32:56.435Z",
"dateReserved": "2024-06-04T13:49:31.496Z",
"dateUpdated": "2025-02-13T17:54:22.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-56807 (GCVE-0-2024-56807)
Vulnerability from cvelistv5 – Published: 2026-02-11 12:20 – Updated: 2026-02-11 14:23
VLAI
Title
Media Streaming add-on
Summary
An out-of-bounds read vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access, they can then exploit the vulnerability to obtain secret data.
We have already fixed the vulnerability in the following version:
Media Streaming add-on 500.1.1.6 ( 2024/08/02 ) and later
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| QNAP Systems Inc. | Media Streaming add-on |
Affected:
500.1.x , < 500.1.1.6 ( 2024/08/02 )
(custom)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-56807",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-11T14:23:39.836885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-11T14:23:50.298Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Media Streaming add-on",
"vendor": "QNAP Systems Inc.",
"versions": [
{
"lessThan": "500.1.1.6 ( 2024/08/02 )",
"status": "affected",
"version": "500.1.x",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dcs"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An out-of-bounds read vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access, they can then exploit the vulnerability to obtain secret data.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following version:\u003cbr\u003eMedia Streaming add-on 500.1.1.6 ( 2024/08/02 ) and later\u003cbr\u003e"
}
],
"value": "An out-of-bounds read vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access, they can then exploit the vulnerability to obtain secret data.\n\nWe have already fixed the vulnerability in the following version:\nMedia Streaming add-on 500.1.1.6 ( 2024/08/02 ) and later"
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 1.7,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-11T12:20:14.724Z",
"orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"shortName": "qnap"
},
"references": [
{
"url": "https://www.qnap.com/en/security-advisory/qsa-25-57"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "We have already fixed the vulnerability in the following version:\u003cbr\u003eMedia Streaming add-on 500.1.1.6 ( 2024/08/02 ) and later\u003cbr\u003e"
}
],
"value": "We have already fixed the vulnerability in the following version:\nMedia Streaming add-on 500.1.1.6 ( 2024/08/02 ) and later"
}
],
"source": {
"advisory": "QSA-25-57",
"discovery": "EXTERNAL"
},
"title": "Media Streaming add-on",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
"assignerShortName": "qnap",
"cveId": "CVE-2024-56807",
"datePublished": "2026-02-11T12:20:14.724Z",
"dateReserved": "2024-12-31T09:31:29.719Z",
"dateUpdated": "2026-02-11T14:23:50.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-57822 (GCVE-0-2024-57822)
Vulnerability from cvelistv5 – Published: 2025-01-10 00:00 – Updated: 2025-11-03 17:31
VLAI
Summary
In Raptor RDF Syntax Library through 2.0.16, there is a heap-based buffer over-read when parsing triples with the nquads parser in raptor_ntriples_parse_term_internal().
Severity
4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| librdf | Raptor RDF Syntax Library |
Affected:
0 , ≤ 2.0.16
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-57822",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-10T14:49:24.694829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-10T14:49:29.532Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/pedrib/PoC/blob/master/fuzzing/raptor-fuzz.md"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:31:26.627Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00023.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Raptor RDF Syntax Library",
"vendor": "librdf",
"versions": [
{
"lessThanOrEqual": "2.0.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:librdf:raptor_rdf_syntax_library:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.0.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Raptor RDF Syntax Library through 2.0.16, there is a heap-based buffer over-read when parsing triples with the nquads parser in raptor_ntriples_parse_term_internal()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-10T13:24:20.261Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/pedrib/PoC/blob/master/fuzzing/raptor-fuzz.md"
},
{
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1067896"
},
{
"url": "https://github.com/dajobe/raptor/issues/70"
}
],
"x_generator": {
"engine": "enrichogram 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-57822",
"datePublished": "2025-01-10T00:00:00.000Z",
"dateReserved": "2025-01-10T00:00:00.000Z",
"dateUpdated": "2025-11-03T17:31:26.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-57958 (GCVE-0-2024-57958)
Vulnerability from cvelistv5 – Published: 2025-02-06 12:29 – Updated: 2025-02-06 14:38
VLAI
Summary
Out-of-bounds array read vulnerability in the FFRT module
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-57958",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-06T14:38:27.499649Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-06T14:38:36.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HarmonyOS",
"vendor": "Huawei",
"versions": [
{
"status": "affected",
"version": "5.0.0"
},
{
"status": "affected",
"version": "4.2.0"
},
{
"status": "affected",
"version": "4.0.0"
},
{
"status": "affected",
"version": "4.3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "EMUI",
"vendor": "Huawei",
"versions": [
{
"status": "affected",
"version": "14.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Out-of-bounds array read vulnerability in the FFRT module\u003cbr\u003eImpact: Successful exploitation of this vulnerability may cause features to perform abnormally."
}
],
"value": "Out-of-bounds array read vulnerability in the FFRT module\nImpact: Successful exploitation of this vulnerability may cause features to perform abnormally."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-06T12:29:41.313Z",
"orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"shortName": "huawei"
},
"references": [
{
"url": "https://consumer.huawei.com/en/support/bulletin/2025/2/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
"assignerShortName": "huawei",
"cveId": "CVE-2024-57958",
"datePublished": "2025-02-06T12:29:41.313Z",
"dateReserved": "2025-01-22T03:37:52.395Z",
"dateUpdated": "2025-02-06T14:38:36.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5991 (GCVE-0-2024-5991)
Vulnerability from cvelistv5 – Published: 2024-08-27 18:33 – Updated: 2024-08-27 20:06
VLAI
Title
Buffer overread in domain name matching
Summary
In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509_check_host() takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do a name check on a non-NULL terminated buffer, the code would read beyond the bounds of the input array until it found a NULL terminator.This issue affects wolfSSL: through 5.7.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "wolfssl",
"vendor": "wolfssl",
"versions": [
{
"lessThanOrEqual": "5.7.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5991",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-27T20:04:54.798411Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T20:06:24.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "wolfSSL",
"vendor": "wolfSSL",
"versions": [
{
"lessThanOrEqual": "5.7.0",
"status": "affected",
"version": "0",
"versionType": "release bundle"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIn function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509_check_host() takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do a name check on a non-NULL terminated buffer, the code would read beyond the bounds of the input array until it found a NULL terminator.\u003c/span\u003e\u003cp\u003eThis issue affects wolfSSL: through 5.7.0.\u003c/p\u003e"
}
],
"value": "In function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509_check_host() takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do a name check on a non-NULL terminated buffer, the code would read beyond the bounds of the input array until it found a NULL terminator.This issue affects wolfSSL: through 5.7.0."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-27T18:33:27.550Z",
"orgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27",
"shortName": "wolfSSL"
},
"references": [
{
"url": "https://https://github.com/wolfSSL/wolfssl/pull/7604"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fixed in the following github pull request\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://https://github.com/wolfSSL/wolfssl/pull/7604\"\u003ehttps://https://github.com/wolfSSL/wolfssl/pull/7604\u003c/a\u003e"
}
],
"value": "Fixed in the following github pull request\u00a0 https://https://github.com/wolfSSL/wolfssl/pull/7604"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Buffer overread in domain name matching",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "50d2cd11-d01a-48ed-9441-5bfce9d63b27",
"assignerShortName": "wolfSSL",
"cveId": "CVE-2024-5991",
"datePublished": "2024-08-27T18:33:27.550Z",
"dateReserved": "2024-06-13T21:54:51.320Z",
"dateUpdated": "2024-08-27T20:06:24.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6443 (GCVE-0-2024-6443)
Vulnerability from cvelistv5 – Published: 2024-10-04 05:56 – Updated: 2024-10-04 13:50
VLAI
Title
zephyr: out-of-bound read in utf8_trunc
Summary
In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.
Severity
6.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| zephyrproject-rtos | Zephyr |
Affected:
* , ≤ 3.6
(git)
|
|
| zephyrproject | zephyr |
Affected:
0 , ≤ 3.6
(git)
cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "zephyr",
"vendor": "zephyrproject",
"versions": [
{
"lessThanOrEqual": "3.6",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6443",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-04T13:49:49.688130Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-04T13:50:42.760Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "Zephyr",
"product": "Zephyr",
"repo": "https://github.com/zephyrproject-rtos/zephyr",
"vendor": "zephyrproject-rtos",
"versions": [
{
"lessThanOrEqual": "3.6",
"status": "affected",
"version": "*",
"versionType": "git"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "zephyr: out-of-bound read in utf8_trunc"
}
],
"value": "In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-04T05:56:30.135Z",
"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"shortName": "zephyr"
},
"references": [
{
"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gg46-3rh2-v765"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "zephyr: out-of-bound read in utf8_trunc",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad",
"assignerShortName": "zephyr",
"cveId": "CVE-2024-6443",
"datePublished": "2024-10-04T05:56:30.135Z",
"dateReserved": "2024-07-02T06:00:55.818Z",
"dateUpdated": "2024-10-04T13:50:42.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6505 (GCVE-0-2024-6505)
Vulnerability from cvelistv5 – Published: 2024-07-05 13:51 – Updated: 2025-11-08 07:13
VLAI
Title
Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss
Summary
A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2024-6505 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2295760 | issue-trackingx_refsource_REDHAT |
| https://security.netapp.com/advisory/ntap-2024081… |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
|
Affected:
5.1.0 , < 9.1.0
(semver)
|
|||
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 8 Advanced Virtualization |
cpe:/a:redhat:advanced_virtualization:8::el8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9 |
Date Public
2024-07-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6505",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-13T20:15:08.315330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-13T20:15:15.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-16T17:02:42.843Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/CVE-2024-6505"
},
{
"name": "RHBZ#2295760",
"tags": [
"issue-tracking",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295760"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240816-0006/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://gitlab.com/qemu-project/qemu",
"defaultStatus": "unaffected",
"packageName": "qemu",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "5.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unknown",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unknown",
"packageName": "qemu-kvm-ma",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "virt:rhel/qemu-kvm",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:advanced_virtualization:8::el8"
],
"defaultStatus": "affected",
"packageName": "virt:av/qemu-kvm",
"product": "Red Hat Enterprise Linux 8 Advanced Virtualization",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "qemu-kvm",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2024-07-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-08T07:13:50.565Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2024-6505"
},
{
"name": "RHBZ#2295760",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295760"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-07-04T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2024-07-04T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss",
"workarounds": [
{
"lang": "en",
"value": "A viable mitigation for this vulnerability is to disable RSS on the nic/virtio driver. \nThis can be performed either with the following qemu-kvm command \"-device virtio-net-pci,rss=off\", or, alternatively, by directly modifying the KVM XML file to disable RSS using a standard configuration tool (ex. libvirt)."
}
],
"x_redhatCweChain": "CWE-125: Out-of-bounds Read"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2024-6505",
"datePublished": "2024-07-05T13:51:38.241Z",
"dateReserved": "2024-07-04T09:08:42.796Z",
"dateUpdated": "2025-11-08T07:13:50.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation ID: MIT-5
Phase: Implementation
Strategy: Input Validation
Description:
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Phase: Architecture and Design
Strategy: Language Selection
Description:
- Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.