CVE-2024-1013

2024-03-1811:15:09

Debian Security Bug Tracker

security-tracker.debian.org

cve-2024-1013

out-of-bounds write

unixodbc

64-bit architectures

little-endian

big-endian

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

7.2

Confidence

Low

EPSS

Percentile

15.5%

JSON

An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.

OSVersionArchitecturePackageVersionFilename
Debian12allunixodbc<= 2.3.11-2+deb12u1unixodbc_2.3.11-2+deb12u1_all.deb
Debian11allunixodbc<= 2.3.6-0.1unixodbc_2.3.6-0.1_all.deb
Debian999allunixodbc<= 2.3.12-1unixodbc_2.3.12-1_all.deb
Debian13allunixodbc<= 2.3.12-1unixodbc_2.3.12-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	unixodbc	<= 2.3.11-2+deb12u1	unixodbc_2.3.11-2+deb12u1_all.deb
Debian	11	all	unixodbc	<= 2.3.6-0.1	unixodbc_2.3.6-0.1_all.deb
Debian	999	all	unixodbc	<= 2.3.12-1	unixodbc_2.3.12-1_all.deb
Debian	13	all	unixodbc	<= 2.3.12-1	unixodbc_2.3.12-1_all.deb