CVE-2024-34403

2024-05-0301:15:48

Debian Security Bug Tracker

security-tracker.debian.org

uriparser

integer overflow

composequerymallocexmm

uriquery.c

cve-2024-34403

unix

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

10.3%

JSON

An issue was discovered in uriparser through 0.9.7. ComposeQueryMallocExMm in UriQuery.c has an integer overflow via a long string.

OSVersionArchitecturePackageVersionFilename
Debian12alluriparser<= 0.9.7+dfsg-2uriparser_0.9.7+dfsg-2_all.deb
Debian11alluriparser<= 0.9.4+dfsg-1+deb11u1uriparser_0.9.4+dfsg-1+deb11u1_all.deb
Debian999alluriparser< 0.9.8+dfsg-1uriparser_0.9.8+dfsg-1_all.deb
Debian13alluriparser< 0.9.8+dfsg-1uriparser_0.9.8+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	uriparser	<= 0.9.7+dfsg-2	uriparser_0.9.7+dfsg-2_all.deb
Debian	11	all	uriparser	<= 0.9.4+dfsg-1+deb11u1	uriparser_0.9.4+dfsg-1+deb11u1_all.deb
Debian	999	all	uriparser	< 0.9.8+dfsg-1	uriparser_0.9.8+dfsg-1_all.deb
Debian	13	all	uriparser	< 0.9.8+dfsg-1	uriparser_0.9.8+dfsg-1_all.deb