CVE-2024-36600 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.4 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	ADP	8.4 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 23%

Affected Products (NVD)

Vendor	Product	Version
gnu	libcdio	2.2.0 ≤ 𝑥 ≤ 2.3.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libcdio

bookworm	2.1.0-4 fixed
bullseye	2.1.0-2 fixed
forky	2.2.0-4 fixed
sid	2.2.0-4 fixed
trixie	2.2.0-4 fixed

Ubuntu Releases

Ubuntu Product

Codename

libcdio

bionic	Fixed 1.0.0-2ubuntu2+esm2 released
focal	Fixed 2.0.0-2ubuntu0.2 released
jammy	Fixed 2.1.0-3ubuntu0.2 released
mantic	Fixed 2.1.0-4ubuntu0.2 released
noble	Fixed 2.1.0-4.1ubuntu1.2 released
trusty	Fixed 0.83-4.1ubuntu1+esm3 released
xenial	Fixed 0.83-4.2ubuntu1+esm3 released

Known Exploits!

Common Weakness Enumeration

CWE-121 - Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References

https://bugzilla.redhat.com/show_bug.cgi?id=2292833

https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600

https://github.com/libcdio/libcdio/pull/32

https://github.com/libcdio/libcdio/pull/46

https://github.com/gashasbi/My-Reports/tree/main/CVE-2024-36600