Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2024-43598 (GCVE-0-2024-43598)
Vulnerability from cvelistv5 – Published: 2024-11-12 17:53 – Updated: 2025-07-08 15:41
VLAI?
EPSS
Summary
LightGBM Remote Code Execution Vulnerability
Severity ?
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-43598",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-15T04:55:49.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "LightGBM",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "4.6.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:lightgbm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2024-11-12T08:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "LightGBM Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T15:41:29.737Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "LightGBM Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598"
}
],
"title": "LightGBM Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2024-43598",
"datePublished": "2024-11-12T17:53:58.216Z",
"dateReserved": "2024-08-14T01:08:33.550Z",
"dateUpdated": "2025-07-08T15:41:29.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:lightgbm:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"4.6.0\", \"matchCriteriaId\": \"7EA9DF56-BE4E-47D9-B522-BFB4593C7B1E\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"LightGBM Remote Code Execution Vulnerability\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de ejecuci\\u00f3n remota de c\\u00f3digo en LightGBM\"}]",
"id": "CVE-2024-43598",
"lastModified": "2024-11-19T03:52:01.630",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"secure@microsoft.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}]}",
"published": "2024-11-12T18:15:28.277",
"references": "[{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598\", \"source\": \"secure@microsoft.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": "[{\"source\": \"secure@microsoft.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-122\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-43598\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2024-11-12T18:15:28.277\",\"lastModified\":\"2024-11-19T03:52:01.630\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"LightGBM Remote Code Execution Vulnerability\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en LightGBM\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:lightgbm:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.6.0\",\"matchCriteriaId\":\"7EA9DF56-BE4E-47D9-B522-BFB4593C7B1E\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43598\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-13T17:21:38.732363Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-13T17:21:37.160Z\"}}], \"cna\": {\"title\": \"LightGBM Remote Code Execution Vulnerability\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Microsoft\", \"product\": \"LightGBM\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.0.0\", \"lessThan\": \"4.6.0\", \"versionType\": \"custom\"}], \"platforms\": [\"Unknown\"]}], \"datePublic\": \"2024-11-12T08:00:00.000Z\", \"references\": [{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598\", \"name\": \"LightGBM Remote Code Execution Vulnerability\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"LightGBM Remote Code Execution Vulnerability\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-122\", \"description\": \"CWE-122: Heap-based Buffer Overflow\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:lightgbm:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.6.0\", \"versionStartIncluding\": \"1.0.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\", \"dateUpdated\": \"2025-06-16T02:44:13.244Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-43598\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-16T02:44:13.244Z\", \"dateReserved\": \"2024-08-14T01:08:33.550Z\", \"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"datePublished\": \"2024-11-12T17:53:58.216Z\", \"assignerShortName\": \"microsoft\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
CERTFR-2024-AVI-0978
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) versions antérieures à 14.0.2070.1 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.6 antérieures à 17.6.21 | ||
| Microsoft | N/A | Microsoft SharePoint Server Subscription Edition versions antérieures à 16.0.17928.20238 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 13 versions antérieures à 15.02.1258.038 | ||
| Microsoft | N/A | Microsoft PC Manager versions antérieures à 3.14.10.0 | ||
| Microsoft | N/A | Greffon Python pour Visual Studio Code versions antérieures à 2024.18.2 | ||
| Microsoft | N/A | Microsoft TorchGeo versions antérieures à 0.6.1 | ||
| Microsoft | N/A | Microsoft SharePoint Server 2019 versions antérieures à 16.0.10416.20000 | ||
| Microsoft | N/A | Microsoft Defender pour Endpoint pour Android versions antérieures à 1.0.7001.0101 | ||
| Microsoft | N/A | Microsoft Defender pour Endpoint pour iOS versions antérieures à 1.1.58140101 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.10 antérieures à 17.10.9 | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (GDR) versions antérieures à 16.0.1135.2 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) versions antérieures à 15.0.2130.3 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 14 versions antérieures à 15.02.1544.013 | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) versions antérieures à 13.0.6455.2 | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 versions antérieures à 15.01.2507.043 | ||
| Microsoft | N/A | Greffon SSH pour Visual Studio Code versions antérieures à 0.115.1 | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 31) versions antérieures à 14.0.3485.1 | ||
| Microsoft | N/A | Microsoft SharePoint Enterprise Server 2016 versions antérieures à 16.0.5474.1001 | ||
| Microsoft | N/A | LightGBM versions antérieures à 4.6.0 | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (CU 15) versions antérieures à 16.0.4155.4 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.8 antérieures à 17.8.16 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.11 antérieures à 17.11.6 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 29) versions antérieures à 15.0.4410.1 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 14.0.2070.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.6 ant\u00e9rieures \u00e0 17.6.21",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Server Subscription Edition versions ant\u00e9rieures \u00e0 16.0.17928.20238",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 13 versions ant\u00e9rieures \u00e0 15.02.1258.038",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft PC Manager versions ant\u00e9rieures \u00e0 3.14.10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Greffon Python pour Visual Studio Code versions ant\u00e9rieures \u00e0 2024.18.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft TorchGeo versions ant\u00e9rieures \u00e0 0.6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Server 2019 versions ant\u00e9rieures \u00e0 16.0.10416.20000",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour Endpoint pour Android versions ant\u00e9rieures \u00e0 1.0.7001.0101",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour Endpoint pour iOS versions ant\u00e9rieures \u00e0 1.1.58140101",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.10 ant\u00e9rieures \u00e0 17.10.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 16.0.1135.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 15.0.2130.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 14 versions ant\u00e9rieures \u00e0 15.02.1544.013",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR) versions ant\u00e9rieures \u00e0 13.0.6455.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23 versions ant\u00e9rieures \u00e0 15.01.2507.043",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Greffon SSH pour Visual Studio Code versions ant\u00e9rieures \u00e0 0.115.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31) versions ant\u00e9rieures \u00e0 14.0.3485.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Enterprise Server 2016 versions ant\u00e9rieures \u00e0 16.0.5474.1001",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "LightGBM versions ant\u00e9rieures \u00e0 4.6.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (CU 15) versions ant\u00e9rieures \u00e0 16.0.4155.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.8 ant\u00e9rieures \u00e0 17.8.16",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.11 ant\u00e9rieures \u00e0 17.11.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 29) versions ant\u00e9rieures \u00e0 15.0.4410.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-48997",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48997"
},
{
"name": "CVE-2024-49002",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49002"
},
{
"name": "CVE-2024-48998",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48998"
},
{
"name": "CVE-2024-49050",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49050"
},
{
"name": "CVE-2024-48996",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48996"
},
{
"name": "CVE-2024-49013",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49013"
},
{
"name": "CVE-2024-49018",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49018"
},
{
"name": "CVE-2024-49012",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49012"
},
{
"name": "CVE-2024-49006",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49006"
},
{
"name": "CVE-2024-48999",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48999"
},
{
"name": "CVE-2024-49040",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49040"
},
{
"name": "CVE-2024-49010",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49010"
},
{
"name": "CVE-2024-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43499"
},
{
"name": "CVE-2024-43598",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43598"
},
{
"name": "CVE-2024-49049",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49049"
},
{
"name": "CVE-2024-49011",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49011"
},
{
"name": "CVE-2024-49043",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49043"
},
{
"name": "CVE-2024-49015",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49015"
},
{
"name": "CVE-2024-49009",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49009"
},
{
"name": "CVE-2024-49014",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49014"
},
{
"name": "CVE-2024-5535",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5535"
},
{
"name": "CVE-2024-38255",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38255"
},
{
"name": "CVE-2024-49003",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49003"
},
{
"name": "CVE-2024-48993",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48993"
},
{
"name": "CVE-2024-49008",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49008"
},
{
"name": "CVE-2024-49005",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49005"
},
{
"name": "CVE-2024-49021",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49021"
},
{
"name": "CVE-2024-49007",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49007"
},
{
"name": "CVE-2024-49051",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49051"
},
{
"name": "CVE-2024-49004",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49004"
},
{
"name": "CVE-2024-49044",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49044"
},
{
"name": "CVE-2024-49017",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49017"
},
{
"name": "CVE-2024-43462",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43462"
},
{
"name": "CVE-2024-48994",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48994"
},
{
"name": "CVE-2024-48995",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48995"
},
{
"name": "CVE-2024-49001",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49001"
},
{
"name": "CVE-2024-49000",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49000"
},
{
"name": "CVE-2024-43498",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43498"
},
{
"name": "CVE-2024-49048",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49048"
},
{
"name": "CVE-2024-49016",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49016"
},
{
"name": "CVE-2024-43459",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43459"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0978",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-11-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Microsoft. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48994",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48994"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49048",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49048"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-43498",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43498"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49051",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49051"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49043",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49043"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49014",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49014"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-43462",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43462"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49004",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49004"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49016",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49016"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49010",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49010"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49040",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49040"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48998",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48998"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49018",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49018"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49005",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49005"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49050",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49050"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49044",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49044"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49000",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49000"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49003",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49003"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49008",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49009",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49009"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-38255",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38255"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48995",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48995"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49011",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49011"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49013",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49013"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49017",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49017"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49015",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49015"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49012",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49012"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48997",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48997"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48996",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48996"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-43598",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49001",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49001"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49021",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49021"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-43459",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43459"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-43499",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43499"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49007",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49007"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49002",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49002"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49006",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49006"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49049",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49049"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48999",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48999"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48993",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48993"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-5535",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-5535"
}
]
}
CERTFR-2024-AVI-0978
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) versions antérieures à 14.0.2070.1 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.6 antérieures à 17.6.21 | ||
| Microsoft | N/A | Microsoft SharePoint Server Subscription Edition versions antérieures à 16.0.17928.20238 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 13 versions antérieures à 15.02.1258.038 | ||
| Microsoft | N/A | Microsoft PC Manager versions antérieures à 3.14.10.0 | ||
| Microsoft | N/A | Greffon Python pour Visual Studio Code versions antérieures à 2024.18.2 | ||
| Microsoft | N/A | Microsoft TorchGeo versions antérieures à 0.6.1 | ||
| Microsoft | N/A | Microsoft SharePoint Server 2019 versions antérieures à 16.0.10416.20000 | ||
| Microsoft | N/A | Microsoft Defender pour Endpoint pour Android versions antérieures à 1.0.7001.0101 | ||
| Microsoft | N/A | Microsoft Defender pour Endpoint pour iOS versions antérieures à 1.1.58140101 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.10 antérieures à 17.10.9 | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (GDR) versions antérieures à 16.0.1135.2 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) versions antérieures à 15.0.2130.3 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 14 versions antérieures à 15.02.1544.013 | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) versions antérieures à 13.0.6455.2 | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 versions antérieures à 15.01.2507.043 | ||
| Microsoft | N/A | Greffon SSH pour Visual Studio Code versions antérieures à 0.115.1 | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 31) versions antérieures à 14.0.3485.1 | ||
| Microsoft | N/A | Microsoft SharePoint Enterprise Server 2016 versions antérieures à 16.0.5474.1001 | ||
| Microsoft | N/A | LightGBM versions antérieures à 4.6.0 | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (CU 15) versions antérieures à 16.0.4155.4 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.8 antérieures à 17.8.16 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.11 antérieures à 17.11.6 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 29) versions antérieures à 15.0.4410.1 |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 14.0.2070.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.6 ant\u00e9rieures \u00e0 17.6.21",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Server Subscription Edition versions ant\u00e9rieures \u00e0 16.0.17928.20238",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 13 versions ant\u00e9rieures \u00e0 15.02.1258.038",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft PC Manager versions ant\u00e9rieures \u00e0 3.14.10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Greffon Python pour Visual Studio Code versions ant\u00e9rieures \u00e0 2024.18.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft TorchGeo versions ant\u00e9rieures \u00e0 0.6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Server 2019 versions ant\u00e9rieures \u00e0 16.0.10416.20000",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour Endpoint pour Android versions ant\u00e9rieures \u00e0 1.0.7001.0101",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour Endpoint pour iOS versions ant\u00e9rieures \u00e0 1.1.58140101",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.10 ant\u00e9rieures \u00e0 17.10.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 16.0.1135.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 15.0.2130.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 14 versions ant\u00e9rieures \u00e0 15.02.1544.013",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR) versions ant\u00e9rieures \u00e0 13.0.6455.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23 versions ant\u00e9rieures \u00e0 15.01.2507.043",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Greffon SSH pour Visual Studio Code versions ant\u00e9rieures \u00e0 0.115.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31) versions ant\u00e9rieures \u00e0 14.0.3485.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Enterprise Server 2016 versions ant\u00e9rieures \u00e0 16.0.5474.1001",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "LightGBM versions ant\u00e9rieures \u00e0 4.6.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (CU 15) versions ant\u00e9rieures \u00e0 16.0.4155.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.8 ant\u00e9rieures \u00e0 17.8.16",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.11 ant\u00e9rieures \u00e0 17.11.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 29) versions ant\u00e9rieures \u00e0 15.0.4410.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-48997",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48997"
},
{
"name": "CVE-2024-49002",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49002"
},
{
"name": "CVE-2024-48998",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48998"
},
{
"name": "CVE-2024-49050",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49050"
},
{
"name": "CVE-2024-48996",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48996"
},
{
"name": "CVE-2024-49013",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49013"
},
{
"name": "CVE-2024-49018",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49018"
},
{
"name": "CVE-2024-49012",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49012"
},
{
"name": "CVE-2024-49006",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49006"
},
{
"name": "CVE-2024-48999",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48999"
},
{
"name": "CVE-2024-49040",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49040"
},
{
"name": "CVE-2024-49010",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49010"
},
{
"name": "CVE-2024-43499",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43499"
},
{
"name": "CVE-2024-43598",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43598"
},
{
"name": "CVE-2024-49049",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49049"
},
{
"name": "CVE-2024-49011",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49011"
},
{
"name": "CVE-2024-49043",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49043"
},
{
"name": "CVE-2024-49015",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49015"
},
{
"name": "CVE-2024-49009",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49009"
},
{
"name": "CVE-2024-49014",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49014"
},
{
"name": "CVE-2024-5535",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5535"
},
{
"name": "CVE-2024-38255",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38255"
},
{
"name": "CVE-2024-49003",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49003"
},
{
"name": "CVE-2024-48993",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48993"
},
{
"name": "CVE-2024-49008",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49008"
},
{
"name": "CVE-2024-49005",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49005"
},
{
"name": "CVE-2024-49021",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49021"
},
{
"name": "CVE-2024-49007",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49007"
},
{
"name": "CVE-2024-49051",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49051"
},
{
"name": "CVE-2024-49004",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49004"
},
{
"name": "CVE-2024-49044",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49044"
},
{
"name": "CVE-2024-49017",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49017"
},
{
"name": "CVE-2024-43462",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43462"
},
{
"name": "CVE-2024-48994",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48994"
},
{
"name": "CVE-2024-48995",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48995"
},
{
"name": "CVE-2024-49001",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49001"
},
{
"name": "CVE-2024-49000",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49000"
},
{
"name": "CVE-2024-43498",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43498"
},
{
"name": "CVE-2024-49048",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49048"
},
{
"name": "CVE-2024-49016",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49016"
},
{
"name": "CVE-2024-43459",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43459"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0978",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-11-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Microsoft. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48994",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48994"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49048",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49048"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-43498",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43498"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49051",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49051"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49043",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49043"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49014",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49014"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-43462",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43462"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49004",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49004"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49016",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49016"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49010",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49010"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49040",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49040"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48998",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48998"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49018",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49018"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49005",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49005"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49050",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49050"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49044",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49044"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49000",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49000"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49003",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49003"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49008",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49009",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49009"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-38255",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38255"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48995",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48995"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49011",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49011"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49013",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49013"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49017",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49017"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49015",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49015"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49012",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49012"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48997",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48997"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48996",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48996"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-43598",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49001",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49001"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49021",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49021"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-43459",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43459"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-43499",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43499"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49007",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49007"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49002",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49002"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49006",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49006"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-49049",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49049"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48999",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48999"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-48993",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-48993"
},
{
"published_at": "2024-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2024-5535",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-5535"
}
]
}
GHSA-2586-F3P4-HQ84
Vulnerability from github – Published: 2024-11-12 18:30 – Updated: 2025-02-18 19:25
VLAI?
Summary
LightGBM Remote Code Execution Vulnerability
Details
LightGBM Remote Code Execution Vulnerability
Severity ?
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "lightgbm"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "4.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-43598"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-18T19:25:51Z",
"nvd_published_at": "2024-11-12T18:15:28Z",
"severity": "HIGH"
},
"details": "LightGBM Remote Code Execution Vulnerability",
"id": "GHSA-2586-f3p4-hq84",
"modified": "2025-02-18T19:25:51Z",
"published": "2024-11-12T18:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43598"
},
{
"type": "PACKAGE",
"url": "https://github.com/microsoft/LightGBM"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/lightgbm/PYSEC-2024-231.yaml"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"type": "CVSS_V3"
}
],
"summary": "LightGBM Remote Code Execution Vulnerability"
}
MSRC_CVE-2024-43598
Vulnerability from csaf_microsoft - Published: 2024-11-12 08:00 - Updated: 2024-11-14 08:00Summary
LightGBM Remote Code Execution Vulnerability
Notes
Additional Resources
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer
The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Customer Action
Required. The vulnerability documented by this CVE requires customer action to resolve.
{
"document": {
"acknowledgments": [
{
"names": [
"Tian Yu \u003ca href=\"https://huntr.com/users/0gur1\"\u003e(@0gur1)\u003c/a\u003e. Submitted to \u003ca href=\"huntr.com\"\u003e Huntr\u003c/a\u003e by \u003ca href=\"protectai.com\"\u003e ProtectAI\u003c/a\u003e"
]
}
],
"aggregate_severity": {
"namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
},
{
"category": "general",
"text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
"title": "Customer Action"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2024-43598 LightGBM Remote Code Execution Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598"
},
{
"category": "self",
"summary": "CVE-2024-43598 LightGBM Remote Code Execution Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/advisories/2024/msrc_cve-2024-43598.json"
},
{
"category": "external",
"summary": "Microsoft Exploitability Index",
"url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "LightGBM Remote Code Execution Vulnerability",
"tracking": {
"current_release_date": "2024-11-14T08:00:00.000Z",
"generator": {
"date": "2025-07-10T21:42:55.232Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2024-43598",
"initial_release_date": "2024-11-12T08:00:00.000Z",
"revision_history": [
{
"date": "2024-11-12T08:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
},
{
"date": "2024-11-14T08:00:00.000Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Updated FAQs and updated the CVSS score. These are informational changes only."
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c4.6.0",
"product": {
"name": "LightGBM \u003c4.6.0",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "4.6.0",
"product": {
"name": "LightGBM 4.6.0",
"product_id": "12435"
}
}
],
"category": "product_name",
"name": "LightGBM"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-43598",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "general",
"text": "Microsoft",
"title": "Assigning CNA"
},
{
"category": "faq",
"text": "Successful exploitation of this vulnerability requires an attacker to win a race condition.",
"title": "According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?"
}
],
"product_status": {
"fixed": [
"12435"
],
"known_affected": [
"1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-43598 LightGBM Remote Code Execution Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598"
},
{
"category": "self",
"summary": "CVE-2024-43598 LightGBM Remote Code Execution Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/advisories/2024/msrc_cve-2024-43598.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2024-11-12T08:00:00.000Z",
"details": "4.6.0:Security Update:https://lightgbm.readthedocs.io/en/stable/",
"product_ids": [
"1"
],
"url": "https://lightgbm.readthedocs.io/en/stable/"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalsScore": 0.0,
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 7.1,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Remote Code Execution"
},
{
"category": "exploit_status",
"details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
}
],
"title": "LightGBM Remote Code Execution Vulnerability"
}
]
}
FKIE_CVE-2024-43598
Vulnerability from fkie_nvd - Published: 2024-11-12 18:15 - Updated: 2024-11-19 03:52
Severity ?
Summary
LightGBM Remote Code Execution Vulnerability
References
| URL | Tags | ||
|---|---|---|---|
| secure@microsoft.com | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598 | Patch, Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:lightgbm:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7EA9DF56-BE4E-47D9-B522-BFB4593C7B1E",
"versionEndExcluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "LightGBM Remote Code Execution Vulnerability"
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en LightGBM"
}
],
"id": "CVE-2024-43598",
"lastModified": "2024-11-19T03:52:01.630",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Primary"
}
]
},
"published": "2024-11-12T18:15:28.277",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
}
],
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CNVD-2024-45323
Vulnerability from cnvd - Published: 2024-11-26
VLAI Severity ?
Title
Microsoft LightGBM远程代码执行漏洞
Description
Microsoft LightGBM是美国微软（Microsoft）公司的一个使用基于树的学习算法的梯度提升框架。
Microsoft LightGBM存在远程代码执行漏洞。攻击者可利用该漏洞在系统上执行任意代码。
Severity
高
Patch Name
Microsoft LightGBM远程代码执行漏洞的补丁
Patch Description
Microsoft LightGBM是美国微软（Microsoft）公司的一个使用基于树的学习算法的梯度提升框架。
Microsoft LightGBM存在远程代码执行漏洞。攻击者可利用该漏洞在系统上执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
厂商已发布了漏洞修复程序，请及时关注更新： https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598
Reference
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598
Impacted products
| Name | Microsoft Microsoft LightGBM |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2024-43598",
"cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43598"
}
},
"description": "Microsoft LightGBM\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u4f7f\u7528\u57fa\u4e8e\u6811\u7684\u5b66\u4e60\u7b97\u6cd5\u7684\u68af\u5ea6\u63d0\u5347\u6846\u67b6\u3002\n\nMicrosoft LightGBM\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
"formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2024-45323",
"openTime": "2024-11-26",
"patchDescription": "Microsoft LightGBM\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u4f7f\u7528\u57fa\u4e8e\u6811\u7684\u5b66\u4e60\u7b97\u6cd5\u7684\u68af\u5ea6\u63d0\u5347\u6846\u67b6\u3002\r\n\r\nMicrosoft LightGBM\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Microsoft LightGBM\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "Microsoft Microsoft LightGBM"
},
"referenceLink": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598",
"serverity": "\u9ad8",
"submitTime": "2024-11-15",
"title": "Microsoft LightGBM\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}
WID-SEC-W-2024-3449
Vulnerability from csaf_certbund - Published: 2024-11-12 23:00 - Updated: 2024-11-12 23:00Summary
Microsoft LightGBM und TorchGeo: Mehrere Schwachstellen ermöglichen Codeausführung
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Microsoft bietet in der Apps-Produktfamilie zahlreiche Anwendungen an.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft LightGBM und TorchGeo ausnutzen, um beliebigen Programmcode auszuführen.
Betroffene Betriebssysteme
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Microsoft bietet in der Apps-Produktfamilie zahlreiche Anwendungen an.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft LightGBM und TorchGeo ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2024-3449 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3449.json"
},
{
"category": "self",
"summary": "WID-SEC-2024-3449 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3449"
},
{
"category": "external",
"summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates",
"url": "https://msrc.microsoft.com/update-guide/"
}
],
"source_lang": "en-US",
"title": "Microsoft LightGBM und TorchGeo: Mehrere Schwachstellen erm\u00f6glichen Codeausf\u00fchrung",
"tracking": {
"current_release_date": "2024-11-12T23:00:00.000+00:00",
"generator": {
"date": "2024-11-13T12:16:12.304+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.8"
}
},
"id": "WID-SEC-W-2024-3449",
"initial_release_date": "2024-11-12T23:00:00.000+00:00",
"revision_history": [
{
"date": "2024-11-12T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "TorchGeo",
"product": {
"name": "Microsoft Apps TorchGeo",
"product_id": "T039033",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:apps:torchgeo"
}
}
},
{
"category": "product_version",
"name": "LightGBM",
"product": {
"name": "Microsoft Apps LightGBM",
"product_id": "T039034",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:apps:lightgbm"
}
}
}
],
"category": "product_name",
"name": "Apps"
}
],
"category": "vendor",
"name": "Microsoft"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-43598",
"notes": [
{
"category": "description",
"text": "In den Microsoft Anwendungen LightGBM und TorchGeo existieren mehrere Schwachstellen. Diese wurden noch nicht im Detail offengelegt. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren. Um diese Schwachstelle erfolgreich auszunutzen, muss ein Angreifer vor der Ausnutzung zus\u00e4tzliche Ma\u00dfnahmen ergreifen, um die Zielumgebung vorzubereiten."
}
],
"product_status": {
"known_affected": [
"T039034",
"T039033"
]
},
"release_date": "2024-11-12T23:00:00.000+00:00",
"title": "CVE-2024-43598"
},
{
"cve": "CVE-2024-49048",
"notes": [
{
"category": "description",
"text": "In den Microsoft Anwendungen LightGBM und TorchGeo existieren mehrere Schwachstellen. Diese wurden noch nicht im Detail offengelegt. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren. Um diese Schwachstelle erfolgreich auszunutzen, muss ein Angreifer vor der Ausnutzung zus\u00e4tzliche Ma\u00dfnahmen ergreifen, um die Zielumgebung vorzubereiten."
}
],
"product_status": {
"known_affected": [
"T039034",
"T039033"
]
},
"release_date": "2024-11-12T23:00:00.000+00:00",
"title": "CVE-2024-49048"
}
]
}
PYSEC-2024-231
Vulnerability from pysec - Published: 2024-11-12 18:15 - Updated: 2025-02-15 07:20
VLAI?
Details
LightGBM Remote Code Execution Vulnerability
Severity ?
8.1 (High)
Impacted products
| Name | purl | lightgbm | pkg:pypi/lightgbm |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "lightgbm",
"purl": "pkg:pypi/lightgbm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.10",
"2.0.11",
"2.0.12",
"2.0.2",
"2.0.3",
"2.0.4",
"2.0.5",
"2.0.6",
"2.0.7",
"2.1.0",
"2.1.1",
"2.1.2",
"2.2.0",
"2.2.1",
"2.2.2",
"2.2.3",
"2.3.0",
"2.3.1",
"3.0.0",
"3.0.0rc1",
"3.1.0",
"3.1.1",
"3.2.0",
"3.2.1",
"3.3.0",
"3.3.1",
"3.3.2",
"3.3.3",
"3.3.4",
"3.3.5",
"4.0.0",
"4.1.0",
"4.2.0",
"4.3.0",
"4.4.0",
"4.5.0"
]
}
],
"aliases": [
"CVE-2024-43598"
],
"details": "LightGBM Remote Code Execution Vulnerability",
"id": "PYSEC-2024-231",
"modified": "2025-02-15T07:20:34.246161+00:00",
"published": "2024-11-12T18:15:28+00:00",
"references": [
{
"type": "ADVISORY",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598"
},
{
"type": "FIX",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43598"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…