{"id":"CVE-2024-31636","aliases":["DEBIAN-CVE-2024-31636","EUVD-2024-1873","GHSA-377p-g8gr-5wpg","PYSEC-2024-280","UBUNTU-CVE-2024-31636"],"status":"published","title":"LIEF obtain sensitive information via the name parameter","description":"An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0024,"percentile":0.15278,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-457"],"published":"2024-05-03T00:00:00Z","modified":"2026-11-02T12:02:30Z","fixes":[{"ecosystem":"PyPI","package":"lief","fixed_in":["0.15.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"lief","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lief","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-1"]},{"source":"osv","ecosystem":"PyPI","package":"lief","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.12.0","0.12.1","0.12.2","0.12.3","0.13.0","0.13.1","0.13.2","0.14.0","0.14.1","0.8.0","0.8.1","0.8.2","0.8.3","0.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"lief","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.14.1"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.11.1","0.11.2","0.11.3","0.11.4","0.11.5","0.12.0","0.12.1","0.12.2","0.12.3","0.13.0","0.13.1","0.13.2","0.14.0","0.14.1","0.8.0","0.8.1","0.8.2","0.8.3","0.9.0"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lief","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-1build1","0.9.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lief","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0-1build2","0.9.0-1build3"]}],"products":[{"vendor":"lief-project","product":"lief"}],"references":[{"url":"https://github.com/lief-project/LIEF","tags":["x_transferred","Product","package","report"]},{"url":"https://github.com/lief-project/LIEF/issues/1038","tags":["x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31636","tags":["advisory"]},{"url":"https://github.com/lief-project/LIEF/commit/307e113f8e00b034f0a5f1baa33e54d636c52ea3","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/lief/PYSEC-2024-280.yaml","tags":["web"]},{"url":"http://lief.com","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-377p-g8gr-5wpg","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31636.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-31636","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-31636","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31636","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-31636","description":"An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.","status":"published","published":"2024-05-03T00:00:00Z","modified":"2026-07-09T00:30:48.992Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-457"],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-1873","description":"An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.","status":"published","published":"2024-05-03T00:00:00Z","modified":"2026-07-09T00:30:48Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:20:05.313723Z"}],"ghsa":[{"id":"GHSA-377p-g8gr-5wpg","title":"LIEF obtain sensitive information via the name parameter","description":"An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.","status":"published","published":"2024-05-03T18:30:37Z","modified":"2026-06-06T00:28:37Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-457"],"updated_at":"2026-11-02T14:40:18.682012Z"}],"nvd":[{"id":"CVE-2024-31636","description":"An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.","status":"published","published":"2024-05-03T17:15:07.687Z","modified":"2026-07-09T01:19:00.94Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-457"],"updated_at":"2026-11-02T14:09:56.122111Z"}],"osv":[{"id":"CVE-2024-31636","description":"An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.","status":"published","published":"2024-05-03T00:00:00Z","modified":"2026-10-28T02:30:39.765590085Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-31636","description":"An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.","status":"published","published":"2024-05-03T17:15:07.687Z","modified":"2026-11-02T12:02:30.492228396Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-377p-g8gr-5wpg","title":"LIEF obtain sensitive information via the name parameter","description":"An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.","status":"published","published":"2024-05-03T18:30:37Z","modified":"2026-06-06T00:45:33.385504927Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-457"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"PYSEC-2024-280","description":"An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.","status":"published","published":"2024-05-03T17:15:07.687Z","modified":"2026-06-10T17:02:01.298619765Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:54.242332Z"},{"id":"UBUNTU-CVE-2024-31636","description":"An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.","status":"published","published":"2024-05-03T17:15:00Z","modified":"2026-04-22T14:49:01.72147Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:54:48.333535Z"}]}}