IM
IronMonkey Threat Research

CVE-2024-52533 CRITICAL

Published: 2024-11-11 | Last Modified: 2025-06-17 | Status: Analyzed

Description

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.

Additional Descriptions (1)

gio/gsocks4aproxy.c en GNOME GLib anterior a 2.82.1 tiene un error de un byte y el consiguiente desbordamiento de búfer porque SOCKS4_CONN_MSG_LEN no es suficiente para un carácter '\0' final.

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Type: Secondary

Exploitability Score: 3.9

Impact Score: 5.9

Weaknesses

Source Type Description
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-120

Affected Products

Vendor Product Version Update Type
gnome glib * <built-in method update of dict object at 0x7fd3694043c0> Application
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd386747140> Operating System
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd38477f240> Application
netapp ontap_tools 10 <built-in method update of dict object at 0x7fd30873e080> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Yes cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*

References