CVE-2024-24684

{"id": "CVE-2024-24684", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-05-28T14:15:11.830", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "source": "talos-cna@cisco.com"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1929", "source": "talos-cna@cisco.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the header parsing occuring while processing an `.off` file via the `readOFF` function. \r\n\r\n\r\nWe can see above that at [0] a stack-based buffer called `comment` is defined with an hardcoded size of `1000 bytes`. The call to `fscanf` at [1] is unsafe and if the first line of the header of the `.off` files is longer than 1000 bytes it will overflow the `header` buffer."}, {"lang": "es", "value": "Existen m\u00faltiples vulnerabilidades de desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria en la funcionalidad readOFF de libigl v2.5.0. Un archivo .off especialmente manipulado puede provocar un desbordamiento de b\u00fafer en la regi\u00f3n stack de la memoria. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad. Esta vulnerabilidad se refiere al an\u00e1lisis del encabezado que se produce al procesar un archivo \".off\" a trav\u00e9s de la funci\u00f3n \"readOFF\". Podemos ver arriba que en [0] se define un b\u00fafer basado en pila llamado \"comentario\" con un tama\u00f1o codificado de \"1000 bytes\". La llamada a `fscanf` en [1] no es segura y si la primera l\u00ednea del encabezado de los archivos `.off` tiene m\u00e1s de 1000 bytes, desbordar\u00e1 el b\u00fafer del `header`."}], "lastModified": "2024-06-10T18:15:26.487", "sourceIdentifier": "talos-cna@cisco.com"}