Every CVE Search/ Get API key

CVE-2024-40897

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39....

6.7 MediumFix available

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.38%Up 0.3 points since Jul 26, 2024
90%50%10%1%

What each source reports

NVD Score used 6.7

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Record
CVE-2024-40897
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787, CWE-121
Updated
2026-11-02
CVE List 7.0

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Record
CVE-2024-40897
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
EUVDEUVD-2024-38708 7.0

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Record
EUVD-2024-38708
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-247v-6wr5-3wf3 7.0

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39....

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Record
GHSA-247v-6wr5-3wf3
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-121, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2024-40897 6.7

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Record
ALPINE-CVE-2024-40897
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-47050 6.7

CVE-2024-40897 affecting package orc 0.4.31-4

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Record
AZL-47050
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 28 moreShow less
OSVAZL-47122 6.7

CVE-2024-40897 affecting package orc for versions less than 0.4.39-2

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Record
AZL-47122
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.0

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Record
CVE-2024-40897
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-40897 6.7

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Record
DEBIAN-CVE-2024-40897
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-1975 7.0

orc security update

Orc is the sucessor to Liboil - The Library of Optimized Inner Loops. Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data. The "language" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

Security Fix(es):

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.(CVE-2024-40897)

Record
OESA-2024-1975
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:5306 6.7

Red Hat Security Advisory: orc security update

Record
RHSA-2024:5306
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:5629 6.7

Red Hat Security Advisory: orc security update

Record
RHSA-2024:5629
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:5638 6.7

Red Hat Security Advisory: orc:0.4.31 security update

Record
RHSA-2024:5638
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:5882 6.7

Red Hat Security Advisory: orc:0.4.28 security update

Record
RHSA-2024:5882
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:6159 6.7

Red Hat Security Advisory: orc security update

Record
RHSA-2024:6159
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2024:6184 6.7

Red Hat Security Advisory: orc security update

Record
RHSA-2024:6184
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2024:5306 6.7

Moderate: orc security update

Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data. The "language" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

Security Fix(es):

  • orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2024:5306
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2024-40897 6.7

CVE-2024-40897 in orc - Patched by Root

Root has patched CVE-2024-40897 in the orc package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2024-40897
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-40897 6.7

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

Record
UBUNTU-CVE-2024-40897
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2024:5306 No score

Moderate: orc security update

Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data. The "language" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

Security Fix(es):

  • orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:5306
Updated
2026-11-02
OSVALSA-2024:6184 No score

Moderate: orc security update

Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data. The "language" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

Security Fix(es):

  • orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2024:6184
Updated
2026-11-02
OSVCLSA-2024-1725650489 No score

orc: Fix of CVE-2024-40897

  • CVE-2024-40897: fix stack buffer overflow while construct error messages
  • Disable gtk-doc building due lack of gtkdoc-mktmpl command in gtk-doc-1.28-2.el7
Record
CLSA-2024-1725650489
Updated
2026-11-02
OSVCLSA-2025-1755114348 No score

orc: Fix of CVE-2024-40897

  • CVE-2024-40897: use vasprintf() if available for error messages and otherwise vsnprintf() to allocate as much memory as required and avoid buffer overflow
Record
CLSA-2025-1755114348
Updated
2026-11-02
OSVMGASA-2024-0288 No score

Updated orc packages fix security vulnerability

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments. (CVE-2024-40897)

Record
MGASA-2024-0288
Updated
2026-11-02
OSVopenSUSE-SU-2024:14216-1 No score

liborc-0_4-0-0.4.39-1.1 on GA media

These are all security issues fixed in the liborc-0_4-0-0.4.39-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14216-1
Updated
2026-11-02
OSVSUSE-SU-2024:2643-1 No score

Security update for orc

This update for orc fixes the following issues:

  • CVE-2024-40897: Fixed stack-based buffer overflow in the orc compiler when formatting error messages for certain input files (bsc#1228184)
Record
SUSE-SU-2024:2643-1
Updated
2026-11-02
OSVSUSE-SU-2024:2663-1 No score

Security update for orc

This update for orc fixes the following issues:

  • CVE-2024-40897: Fixed stack-based buffer overflow in the orc compiler when formatting error messages for certain input files (bsc#1228184)
Record
SUSE-SU-2024:2663-1
Updated
2026-11-02
OSVSUSE-SU-2025:0314-1 No score

Security update for orc

This update for orc fixes the following issues:

  • CVE-2024-40897: Fixed stack-based buffer overflow in the Orc compiler when formatting error messages for certain input files (bsc#1228184)
Record
SUSE-SU-2025:0314-1
Updated
2026-11-02
OSVSUSE-SU-2025:0344-1 No score

Security update for orc

This update for orc fixes the following issues:

  • CVE-2024-40897: Fixed stack-based buffer overflow in the Orc compiler when formatting error messages for certain input files (bsc#1228184)
Record
SUSE-SU-2025:0344-1
Updated
2026-11-02
OSVSUSE-SU-2025:20060-1 No score

Security update for orc

This update for orc fixes the following issues:

  • CVE-2024-40897: Fixed a stack-based buffer overflow when formatting error messages (bsc#1228184)
Record
SUSE-SU-2025:20060-1
Updated
2026-11-02
OSVSUSE-SU-2025:20152-1 No score

Security update for orc

This update for orc fixes the following issues:

  • CVE-2024-40897: Fixed a stack-based buffer overflow in the Orc compiler when formatting error messages for certain input files (bsc#1228184)
Record
SUSE-SU-2025:20152-1
Updated
2026-11-02
OSVSUSE-SU-2025:20272-1 No score

Security update for orc

This update for orc fixes the following issues:

  • CVE-2024-40897: Fixed stack-based buffer overflow inside the orc compiler when formatting error messages for certain input files (bsc#1228184).
Record
SUSE-SU-2025:20272-1
Updated
2026-11-02
OSVUSN-6964-1 No score

orc vulnerability

Noriko Totsuka discovered that ORC incorrectly handled certain crafted file. An attacker could possibly use this issue to execute arbitrary code.

Record
USN-6964-1
Updated
2026-11-02
OSVUSN-6964-2 No score

orc vulnerability

USN-6964-1 fixed a vulnerability in ORC. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

Noriko Totsuka discovered that ORC incorrectly handled certain specially crafted files. An attacker could possibly use this issue to execute arbitrary code.

Record
USN-6964-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
orc
Alpine:v3.17
 before 0.4.39-r0
0.4.39-r0
orc
Alpine:v3.18
 before 0.4.39-r0
0.4.39-r0
orc
Alpine:v3.19
 before 0.4.39-r0
0.4.39-r0
orc
Alpine:v3.20
 before 0.4.39-r0
0.4.39-r0
orc
Alpine:v3.21
 before 0.4.39-r0
0.4.39-r0
orc
Alpine:v3.22
 before 0.4.39-r0
0.4.39-r0
orc
Alpine:v3.23
 before 0.4.39-r0
0.4.39-r0
orc
Alpine:v3.24
 before 0.4.39-r0
0.4.39-r0
orc
AlmaLinux:8
 before 0.4.28-4.el8_10
0.4.28-4.el8_10
orc-compiler
AlmaLinux:8
 before 0.4.28-4.el8_10
0.4.28-4.el8_10
Show 133 moreShow less
Affected packages
PackageAffectedFixed
orc-devel
AlmaLinux:8
 before 0.4.28-4.el8_10
0.4.28-4.el8_10
orc
AlmaLinux:9
 before 0.4.31-7.el9_4
0.4.31-7.el9_4
orc-compiler
AlmaLinux:9
 before 0.4.31-7.el9_4
0.4.31-7.el9_4
orc-devel
AlmaLinux:9
 before 0.4.31-7.el9_4
0.4.31-7.el9_4
orc
Azure Linux:2
 through 0.4.31-4 None known
orc
Azure Linux:3
 before 0.4.39-2
0.4.39-2
orc
TuxCare:CentOS:7
 before 0.4.26-1.el7.tuxcare.els1
0.4.26-1.el7.tuxcare.els1
orc-compiler
TuxCare:CentOS:7
 before 0.4.26-1.el7.tuxcare.els1
0.4.26-1.el7.tuxcare.els1
orc-devel
TuxCare:CentOS:7
 before 0.4.26-1.el7.tuxcare.els1
0.4.26-1.el7.tuxcare.els1
orc-doc
TuxCare:CentOS:7
 before 0.4.26-1.el7.tuxcare.els1
0.4.26-1.el7.tuxcare.els1
orc
TuxCare:AlmaLinux:9.2
 before 0.4.31-6.el9.tuxcare.els1
0.4.31-6.el9.tuxcare.els1
orc-compiler
TuxCare:AlmaLinux:9.2
 before 0.4.31-6.el9.tuxcare.els1
0.4.31-6.el9.tuxcare.els1
orc-devel
TuxCare:AlmaLinux:9.2
 before 0.4.31-6.el9.tuxcare.els1
0.4.31-6.el9.tuxcare.els1
orc-doc
TuxCare:AlmaLinux:9.2
 before 0.4.31-6.el9.tuxcare.els1
0.4.31-6.el9.tuxcare.els1
orc
Debian:12
 All versions, plus listed versions
1:0.4.33-21:0.4.34-11:0.4.34-21:0.4.34-31:0.4.34-3.1~exp1
Show 18 moreShow less
1:0.4.34-41:0.4.34-4.11:0.4.34-4.21:0.4.34-4.31:0.4.38-11:0.4.39-11:0.4.39-21:0.4.39-2+hurd.11:0.4.39-31:0.4.40-11:0.4.41-11:0.4.42-11:0.4.42-21:0.4.42-31:0.4.42-41:0.4.43-11:0.4.43-21:0.4.44-1
 None known
orc
Debian:13
 before 1:0.4.39-1
1:0.4.39-1
orc
Debian:14
 before 1:0.4.39-1
1:0.4.39-1
orc
Mageia:9
 before 0.4.33-1.1.mga9
0.4.33-1.1.mga9
orc
openEuler:24.03-LTS
 before 0.4.34-2.oe2403
0.4.34-2.oe2403
orc
openEuler:22.03-LTS-SP4
 before 0.4.32-3.oe2203sp4
0.4.32-3.oe2203sp4
orc
openEuler:22.03-LTS-SP3
 before 0.4.32-3.oe2203sp3
0.4.32-3.oe2203sp3
orc
openEuler:20.03-LTS-SP4
 before 0.4.31-2.oe2003sp4
0.4.31-2.oe2003sp4
orc
openEuler:22.03-LTS-SP1
 before 0.4.32-3.oe2203sp1
0.4.32-3.oe2203sp1
orc
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-4.el8_10
0:0.4.28-4.el8_10
orc-compiler
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-4.el8_10
0:0.4.28-4.el8_10
orc-compiler-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-4.el8_10
0:0.4.28-4.el8_10
orc-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-4.el8_10
0:0.4.28-4.el8_10
orc-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-4.el8_10
0:0.4.28-4.el8_10
orc-devel
Red Hat:enterprise_linux:8::appstream
 before 0:0.4.28-4.el8_10
0:0.4.28-4.el8_10
orc
Red Hat:rhel_e4s:9.0::appstream
 before 0:0.4.31-7.el9_0
0:0.4.31-7.el9_0
orc-compiler
Red Hat:rhel_e4s:9.0::appstream
 before 0:0.4.31-7.el9_0
0:0.4.31-7.el9_0
orc-compiler-debuginfo
Red Hat:rhel_e4s:9.0::appstream
 before 0:0.4.31-7.el9_0
0:0.4.31-7.el9_0
orc-debuginfo
Red Hat:rhel_e4s:9.0::appstream
 before 0:0.4.31-7.el9_0
0:0.4.31-7.el9_0
orc-debugsource
Red Hat:rhel_e4s:9.0::appstream
 before 0:0.4.31-7.el9_0
0:0.4.31-7.el9_0
orc-devel
Red Hat:rhel_e4s:9.0::appstream
 before 0:0.4.31-7.el9_0
0:0.4.31-7.el9_0
orc
Red Hat:rhel_eus:9.2::appstream
 before 0:0.4.31-7.el9_2
0:0.4.31-7.el9_2
orc-compiler
Red Hat:rhel_eus:9.2::appstream
 before 0:0.4.31-7.el9_2
0:0.4.31-7.el9_2
orc-compiler-debuginfo
Red Hat:rhel_eus:9.2::appstream
 before 0:0.4.31-7.el9_2
0:0.4.31-7.el9_2
orc-debuginfo
Red Hat:rhel_eus:9.2::appstream
 before 0:0.4.31-7.el9_2
0:0.4.31-7.el9_2
orc-debugsource
Red Hat:rhel_eus:9.2::appstream
 before 0:0.4.31-7.el9_2
0:0.4.31-7.el9_2
orc-devel
Red Hat:rhel_eus:9.2::appstream
 before 0:0.4.31-7.el9_2
0:0.4.31-7.el9_2
orc
Red Hat:rhel_aus:8.2::appstream
 before 0:0.4.28-4.el8_2
0:0.4.28-4.el8_2
orc-compiler
Red Hat:rhel_aus:8.2::appstream
 before 0:0.4.28-4.el8_2
0:0.4.28-4.el8_2
orc-compiler-debuginfo
Red Hat:rhel_aus:8.2::appstream
 before 0:0.4.28-4.el8_2
0:0.4.28-4.el8_2
orc-debuginfo
Red Hat:rhel_aus:8.2::appstream
 before 0:0.4.28-4.el8_2
0:0.4.28-4.el8_2
orc-debugsource
Red Hat:rhel_aus:8.2::appstream
 before 0:0.4.28-4.el8_2
0:0.4.28-4.el8_2
orc-devel
Red Hat:rhel_aus:8.2::appstream
 before 0:0.4.28-4.el8_2
0:0.4.28-4.el8_2
orc
Red Hat:rhel_aus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-compiler
Red Hat:rhel_aus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-compiler-debuginfo
Red Hat:rhel_aus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-debuginfo
Red Hat:rhel_aus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-debugsource
Red Hat:rhel_aus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-devel
Red Hat:rhel_aus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc
Red Hat:rhel_e4s:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-compiler
Red Hat:rhel_e4s:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-compiler-debuginfo
Red Hat:rhel_e4s:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-debuginfo
Red Hat:rhel_e4s:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-debugsource
Red Hat:rhel_e4s:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-devel
Red Hat:rhel_e4s:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc
Red Hat:rhel_tus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-compiler
Red Hat:rhel_tus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-compiler-debuginfo
Red Hat:rhel_tus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-debuginfo
Red Hat:rhel_tus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-debugsource
Red Hat:rhel_tus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc-devel
Red Hat:rhel_tus:8.4::appstream
 before 0:0.4.28-4.el8_4
0:0.4.28-4.el8_4
orc
Red Hat:enterprise_linux:9::appstream
 before 0:0.4.31-7.el9_4
0:0.4.31-7.el9_4
orc-compiler
Red Hat:enterprise_linux:9::appstream
 before 0:0.4.31-7.el9_4
0:0.4.31-7.el9_4
orc-compiler-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:0.4.31-7.el9_4
0:0.4.31-7.el9_4
orc-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:0.4.31-7.el9_4
0:0.4.31-7.el9_4
orc-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:0.4.31-7.el9_4
0:0.4.31-7.el9_4
orc-devel
Red Hat:enterprise_linux:9::appstream
 before 0:0.4.31-7.el9_4
0:0.4.31-7.el9_4
orc
Rocky Linux:8
 before 0:0.4.28-4.el8_10
0:0.4.28-4.el8_10
orc
Root:Debian:12
 before 1:0.4.33-2.root.io.1
1:0.4.33-2.root.io.11:0.4.33-2.root.io.21:0.4.33-2.aikido.3
rootio-orc
Root:Debian:12
 before 1:0.4.33-2.root.io.1
1:0.4.33-2.root.io.11:0.4.33-2.root.io.21:0.4.33-2.aikido.3
orc
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 0.4.21-3.3.1
0.4.21-3.3.1
orc
SUSE:Linux Enterprise Server 12 SP5
 before 0.4.21-3.3.1
0.4.21-3.3.1
orc
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.4.21-3.3.1
0.4.21-3.3.1
orc
SUSE:Linux Enterprise Micro 5.3
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Micro 5.4
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Micro 5.5
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Module for Basesystem 15 SP6
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Manager Proxy 4.3
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Manager Server 4.3
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Micro 5.2
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Enterprise Storage 7.1
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
openSUSE:Leap Micro 5.5
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
openSUSE:Leap 15.5
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
openSUSE:Leap 15.6
 before 0.4.28-150000.3.6.1
0.4.28-150000.3.6.1
orc
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 0.4.21-3.6.1
0.4.21-3.6.1
orc
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 0.4.21-3.6.1
0.4.21-3.6.1
orc
SUSE:Linux Enterprise Micro 5.3
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise Micro 5.4
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise Micro 5.5
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise Module for Basesystem 15 SP6
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Manager Proxy 4.3
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Manager Server 4.3
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Enterprise Micro 5.2
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Enterprise Storage 7.1
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
openSUSE:Leap 15.6
 before 0.4.28-150000.3.9.1
0.4.28-150000.3.9.1
orc
SUSE:Linux Micro 6.0
 before 0.4.34-2.1
0.4.34-2.1
orc
SUSE:Linux Micro 6.0
 before 0.4.34-3.1
0.4.34-3.1
orc
SUSE:Linux Micro 6.1
 before 0.4.34-slfo.1.1_2.1
0.4.34-slfo.1.1_2.1
orc
Ubuntu:Pro:16.04:LTS
 before 1:0.4.25-1ubuntu0.1~esm1, plus listed versions
1:0.4.24-11:0.4.25-1
1:0.4.25-1ubuntu0.1~esm1
orc
Ubuntu:Pro:18.04:LTS
 before 1:0.4.28-1ubuntu0.1~esm1, plus listed versions
1:0.4.27-11:0.4.28-1
1:0.4.28-1ubuntu0.1~esm1
orc
Ubuntu:20.04:LTS
 before 1:0.4.31-1ubuntu0.1, plus listed versions
1:0.4.30-11:0.4.31-1
1:0.4.31-1ubuntu0.1
orc
Ubuntu:22.04:LTS
 before 1:0.4.32-2ubuntu0.1, plus listed versions
1:0.4.32-11:0.4.32-1build11:0.4.32-2
1:0.4.32-2ubuntu0.1
orc
Ubuntu:24.04:LTS
 before 1:0.4.38-1ubuntu0.1, plus listed versions
1:0.4.34-31:0.4.38-11:0.4.38-1build1
1:0.4.38-1ubuntu0.1
orc
openSUSE:Tumbleweed
 before 0.4.39-1.1
0.4.39-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-40897 is a medium vulnerability (CVSS 6.7) in Gstreamer Orc, published July 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in orc 0.4.39-r0.

References

Show 41 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open