CVE-2024-3203

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-3203

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-3203.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2024-3203

Related

Published

2024-04-02T22:15:10Z

Modified

2025-01-08T09:52:09.187777Z

Summary

[none]

Details

A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2. Affected is the function ndlz8_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.14.3 is able to address this issue. It is recommended to upgrade the affected component. VDB-259050 is the identifier assigned to this vulnerability.

References

Affected packages

Debian:13 / c-blosc2

Package

Name: c-blosc2
Purl: pkg:deb/debian/c-blosc2?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.13.1+ds-3

Affected versions

2.*

2.11.2+ds-1~exp1

2.12.0+ds-1

2.12.0+ds-2

2.13.1+ds-1

2.13.1+ds-1.1~exp1

2.13.1+ds-1.1

2.13.1+ds-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}