by Kastro
Paper/Archive/CVE-2024-52533

CVE-2024-52533

gnome glib — gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not…

EPSS 2%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.3.743 × 2014.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
glib< 2.82.12.82.1CISA-ADP
RUGGEDCOM RST2428P< V3.3V3.3siemens-SADP
SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family< V3.3V3.3siemens-SADP
SCALANCE XCH328< V3.3V3.3siemens-SADP
SCALANCE XCM324< V3.3V3.3siemens-SADP
SCALANCE XCM328< V3.3V3.3siemens-SADP
SCALANCE XCM332< V3.3V3.3siemens-SADP
SCALANCE XRH334 (24 V DC, 8xFO, CC)< V3.3V3.3siemens-SADP
SCALANCE XRM334 (230 V AC, 12xFO)< V3.3V3.3siemens-SADP
SCALANCE XRM334 (230 V AC, 8xFO)< V3.3V3.3siemens-SADP
SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)< V3.3V3.3siemens-SADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgitlab.gnome.org/Teams/Releng/security/-/wikis/homerefgitlab.gnome.org/GNOME/glib/-/issues/3461refgitlab.gnome.org/GNOME/glib/-/releases/2.82.1refopenwall.com/lists/oss-security/2024/11/12/11reflists.debian.org/debian-lts-announce/2024/11/msg00020.htmlrefsecurity.netapp.com/advisory/ntap-20241206-0009refcert-portal.siemens.com/productcert/html/ssa-398330.htmlrefcert-portal.siemens.com/productcert/html/ssa-202008.htmlrefcert-portal.siemens.com/productcert/html/ssa-089022.html