All the vulnerabilites related to Philip Hazel - xfpt
cve-2024-43700
Vulnerability from cvelistv5
Published
2024-08-29 07:36
Modified
2024-10-15 13:43
Severity ?
EPSS score ?
Summary
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Philip Hazel | xfpt |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:philiphazel:xfpt:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "xfpt", "vendor": "philiphazel", "versions": [ { "lessThan": "1.01", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-43700", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-08-29T13:04:57.356436Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-15T13:43:55.358Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "xfpt", "vendor": "Philip Hazel", "versions": [ { "status": "affected", "version": "prior to 1.01" } ] } ], "descriptions": [ { "lang": "en", "value": "xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user\u0027s environment." } ], "problemTypes": [ { "descriptions": [ { "description": "Stack-based buffer overflow", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2024-08-29T07:36:13.470Z", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert" }, "references": [ { "url": "https://github.com/PhilipHazel/xfpt" }, { "url": "https://github.com/PhilipHazel/xfpt/commit/a690304bbd3fd19e9dfdad50dcc87ad829f744e4" }, { "url": "https://jvn.jp/en/vu/JVNVU96498690/" } ] } }, "cveMetadata": { "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2024-43700", "datePublished": "2024-08-29T07:36:13.470Z", "dateReserved": "2024-08-15T06:21:14.760Z", "dateUpdated": "2024-10-15T13:43:55.358Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
jvndb-2024-006787
Vulnerability from jvndb
Published
2024-08-29 14:07
Modified
2024-08-29 14:07
Severity ?
Summary
xfpt vulnerable to stack-based buffer overflow
Details
xfpt fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability (CWE-121).
Yuhei Kawakoya of NTT Security Holdings Corporation reported this vulnerability to JPCERT/CC.
JPCERT/CC coordinated with the developer.
References
▼ | Type | URL |
---|---|---|
JVN | https://jvn.jp/en/vu/JVNVU96498690/index.html | |
CVE | https://www.cve.org/CVERecord?id=CVE-2024-43700 | |
Stack-based Buffer Overflow(CWE-121) | https://cwe.mitre.org/data/definitions/121.html |
Impacted products
▼ | Vendor | Product |
---|---|---|
Philip Hazel | xfpt |
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-006787.html", "dc:date": "2024-08-29T14:07+09:00", "dcterms:issued": "2024-08-29T14:07+09:00", "dcterms:modified": "2024-08-29T14:07+09:00", "description": "xfpt fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability (CWE-121).\r\n\r\nYuhei Kawakoya of NTT Security Holdings Corporation reported this vulnerability to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.", "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-006787.html", "sec:cpe": { "#text": "cpe:/a:misc:philip_hazel_xfpt", "@product": "xfpt", "@vendor": "Philip Hazel", "@version": "2.2" }, "sec:cvss": { "@score": "7.0", "@severity": "High", "@type": "Base", "@vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "@version": "3.0" }, "sec:identifier": "JVNDB-2024-006787", "sec:references": [ { "#text": "https://jvn.jp/en/vu/JVNVU96498690/index.html", "@id": "JVNVU#96498690", "@source": "JVN" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2024-43700", "@id": "CVE-2024-43700", "@source": "CVE" }, { "#text": "https://cwe.mitre.org/data/definitions/121.html", "@id": "CWE-121", "@title": "Stack-based Buffer Overflow(CWE-121)" } ], "title": "xfpt vulnerable to stack-based buffer overflow" }