5.3 MEDIUM
- CVSS version: 3.1
- Attack vector (AV):
- Attack complexity (AC):
- Privileges required (PR):
- User interaction (UI):
- Scope (S):
- Confidentiality impact (C):
- Integrity impact (I):
- Availability impact (A):
by @pyrox0 Activity log
- Created automatic suggestion
-
@pyrox0
removed
3 packages
- molden
- home-assistant-component-tests.mold_indicator
- tests.home-assistant-component-tests.mold_indicator
rui314 mold Object File input-files.cc initialize_sections heap-based overflow
A vulnerability was detected in rui314 mold up to 2.40.4. This issue affects the function mold::ObjectFilemold::X86_64::initialize_sections of the file src/input-files.cc of the component Object File Handler. Performing a manipulation results in heap-based buffer overflow. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
References
- VDB-350476 | rui314 mold Object File input-files.cc initialize_sections heap-based overflow vdb-entry technical-description
- VDB-350476 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #769772 | rui314 mold mold 2.40.4 and main-branch Heap-based Buffer Overflow third-party-advisory
- https://github.com/rui314/mold/issues/1548 issue-tracking
- https://github.com/oneafter/0209/blob/main/mo2/repro exploit
- https://github.com/rui314/mold/ product
Affected products
- ==2.40.0
- ==2.40.2
- ==2.40.3
- ==2.40.4
- ==2.40.1
Matching in nixpkgs
pkgs.mold
Faster drop-in replacement for existing Unix linkers (unwrapped)
pkgs.mold-wrapped
Faster drop-in replacement for existing Unix linkers (unwrapped) (wrapper script)
pkgs.mold-unwrapped
Faster drop-in replacement for existing Unix linkers (unwrapped)
Ignored packages (3)
pkgs.molden
Display and manipulate molecular structures
pkgs.home-assistant-component-tests.mold_indicator
Open source home automation that puts local control and privacy first
pkgs.tests.home-assistant-component-tests.mold_indicator
Open source home automation that puts local control and privacy first
Package maintainers
-
@azahi Azat Bahawi <azat@bahawi.net>