CVE-2024-25003

2024-02-0907:16:00

Alpine Linux Development Team

security.alpinelinux.org

vulnerability

buffer overflow

input sanitization

arbitrary code execution

unix

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.3

Confidence

Low

EPSS

0.001

Percentile

20.9%

JSON

KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds checking and input sanitization. This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.

OSVersionArchitecturePackageVersionFilename
Alpine3.19-communitynoarchkitty= 0.31.0-r4UNKNOWN
Alpine3.20-communitynoarchkitty= 0.31.0-r7UNKNOWN
Alpineedge-communitynoarchkitty= 0.36.4-r0UNKNOWN