CVE-2024-25817

2024-03-0600:15:52

Debian Security Bug Tracker

security-tracker.debian.org

cve-2024-25817

vulnerability

buffer overflow

eza

local attackers

arbitrary code

.git/head

.git/refs

.git/objects

unix

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

Low

EPSS

Percentile

9.0%

JSON

Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, and .git/objects components.

OSVersionArchitecturePackageVersionFilename
Debian999allrust-eza< 0.18.2-1rust-eza_0.18.2-1_all.deb
Debian13allrust-eza< 0.18.2-1rust-eza_0.18.2-1_all.deb