====================================================================

                               CERT-Renater

                    Note d'Information No. 2024/VULN408
_____________________________________________________________________

DATE                : 07/10/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Libgsf versions prior to 1.14.53.

=====================================================================
https://discourse.gnome.org/t/libgsf-release-1-14-53/24308
https://github.com/advisories/GHSA-7m28-hv5x-hp65
https://github.com/advisories/GHSA-5pmr-hjgq-832v
_____________________________________________________________________

   Libgsf release 1.14.53

mortenw
Morten Welinder


I have just released libgsf 1.14.53 containing a couple of security
fixes.

Distributions are encouraged to update to 1.14.53 or, if they prefer,
to apply OLE2: Fix allocation problems.

CVE-2024-36474, CVE-2024-42415

https://gitlab.gnome.org/GNOME/libgsf/-/issues/34

_____________________________________________________________________


An integer overflow vulnerability exists in the Compound...
High severity Unreviewed Published Oct 3, 2024 to the GitHub
Advisory Database • Updated Oct 3, 2024

Package
No package listed—
Affected versions
Unknown

Patched versions
Unknown


Description

An integer overflow vulnerability exists in the Compound Document
Binary File format parser of the GNOME Project G Structured File
Library (libgsf) version v1.14.52. A specially crafted file can
result in an integer overflow when processing the directory from
the file that allows for an out-of-bounds index to be used when
reading and writing to an array. This can lead to arbitrary code
execution. An attacker can provide a malicious file to trigger
this vulnerability.


References

      https://nvd.nist.gov/vuln/detail/CVE-2024-36474
      https://gitlab.gnome.org/GNOME/libgsf/-/issues/34
      https://talosintelligence.com/vulnerability_reports/TALOS-2024-2068


Published by the National Vulnerability Database Oct 3, 2024
Published to the GitHub Advisory Database Oct 3, 2024
Last updated Oct 3, 2024

Severity
High

8.4/ 10

CVSS v3 base metrics

Attack vector
Local

Attack complexity
Low

Privileges required
None

User interaction
None

Scope
Unchanged

Confidentiality
High

Integrity
High

Availability
High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS score
0.053%
(22nd percentile)

Weaknesses
CWE-190

CVE ID
CVE-2024-36474

GHSA ID
GHSA-7m28-hv5x-hp65

Source code
No known source code

_____________________________________________________________________


An integer overflow vulnerability exists in the Compound...
High severity Unreviewed Published Oct 3, 2024 to the GitHub
Advisory Database • Updated Oct 3, 2024

Package
No package listed— Suggest a package

Affected versions
Unknown

Patched versions
Unknown

Description

An integer overflow vulnerability exists in the Compound Document
Binary File format parser of v1.14.52 of the GNOME Project G
Structured File Library (libgsf). A specially crafted file can
result in an integer overflow that allows for a heap-based buffer
overflow when processing the sector allocation table. This can
lead to arbitrary code execution. An attacker can provide a malicious
file to trigger this vulnerability.


References

      https://nvd.nist.gov/vuln/detail/CVE-2024-42415
      https://gitlab.gnome.org/GNOME/libgsf/-/issues/34
      https://talosintelligence.com/vulnerability_reports/TALOS-2024-2069


Published by the National Vulnerability Database Oct 3, 2024
Published to the GitHub Advisory Database Oct 3, 2024
Last updated Oct 3, 2024

Severity
High

8.4/ 10

CVSS v3 base metrics

Attack vector
Local

Attack complexity
Low

Privileges required
None

User interaction
None

Scope
Unchanged

Confidentiality
High

Integrity
High

Availability
High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS score
0.053%
(22nd percentile)

Weaknesses
CWE-190

CVE ID
CVE-2024-42415

GHSA ID
GHSA-5pmr-hjgq-832v

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================