CVE-2024-1013

An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
redhatCNA
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 18%
VendorProductVersion
unixodbcunixodbc
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
unixodbc
bullseye
unimportant
bookworm
unimportant
forky
unimportant
sid
unimportant
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
unixodbc
plucky
Fixed 2.3.12-1ubuntu1
released
oracular
Fixed 2.3.12-1ubuntu1
released
noble
Fixed 2.3.12-1ubuntu0.24.04.1
released
mantic
Fixed 2.3.12-1ubuntu0.23.10.1
released
jammy
Fixed 2.3.9-5ubuntu0.1
released
focal
Fixed 2.3.6-0.1ubuntu0.1
released
bionic
Fixed 2.3.4-1.1ubuntu3+esm1
released
xenial
Fixed 2.3.1-4.1ubuntu0.1~esm2
released
trusty
needs-triage
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2024-1013
https://bugzilla.redhat.com/show_bug.cgi?id=2260823
https://github.com/lurcher/unixODBC/pull/157
https://access.redhat.com/security/cve/CVE-2024-1013
https://bugzilla.redhat.com/show_bug.cgi?id=2260823
https://github.com/lurcher/unixODBC/pull/157