{"id":"CVE-2024-40897","aliases":["ALPINE-CVE-2024-40897","ALSA-2024:5306","ALSA-2024:6184","AZL-47050","AZL-47122","CLSA-2024-1725650489","CLSA-2025-1755114348","DEBIAN-CVE-2024-40897","EUVD-2024-38708","GHSA-247v-6wr5-3wf3","MGASA-2024-0288","OESA-2024-1975","RHSA-2024:5306","RHSA-2024:5629","RHSA-2024:5638","RHSA-2024:5882","RHSA-2024:6159","RHSA-2024:6184","RLSA-2024:5306","ROOT-OS-DEBIAN-12-CVE-2024-40897","SUSE-SU-2024:2643-1","SUSE-SU-2024:2663-1","SUSE-SU-2025:0314-1","SUSE-SU-2025:0344-1","SUSE-SU-2025:20060-1","SUSE-SU-2025:20152-1","SUSE-SU-2025:20272-1","UBUNTU-CVE-2024-40897","USN-6964-1","USN-6964-2","openSUSE-SU-2024:14216-1"],"status":"published","title":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39....","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00382,"percentile":0.32568,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121","CWE-787"],"published":"2024-07-24T00:00:00Z","modified":"2026-11-02T12:02:38Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"orc","fixed_in":["0.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"orc","fixed_in":["0.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"orc","fixed_in":["0.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"orc","fixed_in":["0.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"orc","fixed_in":["0.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"orc","fixed_in":["0.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"orc","fixed_in":["0.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"orc","fixed_in":["0.4.39-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"orc","fixed_in":["0.4.28-4.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"orc-compiler","fixed_in":["0.4.28-4.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"orc-devel","fixed_in":["0.4.28-4.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"orc","fixed_in":["0.4.31-7.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"orc-compiler","fixed_in":["0.4.31-7.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"orc-devel","fixed_in":["0.4.31-7.el9_4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"orc","fixed_in":["0.4.39-2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"orc","fixed_in":["0.4.26-1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"orc-compiler","fixed_in":["0.4.26-1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"orc-devel","fixed_in":["0.4.26-1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"orc-doc","fixed_in":["0.4.26-1.el7.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"orc","fixed_in":["0.4.31-6.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"orc-compiler","fixed_in":["0.4.31-6.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"orc-devel","fixed_in":["0.4.31-6.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"orc-doc","fixed_in":["0.4.31-6.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"orc","fixed_in":["1:0.4.39-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"orc","fixed_in":["1:0.4.39-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"orc","fixed_in":["0.4.33-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"orc","fixed_in":["0.4.34-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"orc","fixed_in":["0.4.32-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"orc","fixed_in":["0.4.32-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"orc","fixed_in":["0.4.31-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"orc","fixed_in":["0.4.32-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc","fixed_in":["0:0.4.28-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc-compiler","fixed_in":["0:0.4.28-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc-compiler-debuginfo","fixed_in":["0:0.4.28-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc-debuginfo","fixed_in":["0:0.4.28-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc-debugsource","fixed_in":["0:0.4.28-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc-devel","fixed_in":["0:0.4.28-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc","fixed_in":["0:0.4.31-7.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc-compiler","fixed_in":["0:0.4.31-7.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc-compiler-debuginfo","fixed_in":["0:0.4.31-7.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc-debuginfo","fixed_in":["0:0.4.31-7.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc-debugsource","fixed_in":["0:0.4.31-7.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc-devel","fixed_in":["0:0.4.31-7.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc","fixed_in":["0:0.4.31-7.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc-compiler","fixed_in":["0:0.4.31-7.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc-compiler-debuginfo","fixed_in":["0:0.4.31-7.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc-debuginfo","fixed_in":["0:0.4.31-7.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc-debugsource","fixed_in":["0:0.4.31-7.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc-devel","fixed_in":["0:0.4.31-7.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc","fixed_in":["0:0.4.28-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc-compiler","fixed_in":["0:0.4.28-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc-compiler-debuginfo","fixed_in":["0:0.4.28-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc-debuginfo","fixed_in":["0:0.4.28-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc-debugsource","fixed_in":["0:0.4.28-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc-devel","fixed_in":["0:0.4.28-4.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc-compiler","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc-compiler-debuginfo","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc-debuginfo","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc-debugsource","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc-devel","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc-compiler","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc-compiler-debuginfo","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc-debuginfo","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc-debugsource","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc-devel","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc-compiler","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc-compiler-debuginfo","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc-debuginfo","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc-debugsource","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc-devel","fixed_in":["0:0.4.28-4.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc","fixed_in":["0:0.4.31-7.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc-compiler","fixed_in":["0:0.4.31-7.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc-compiler-debuginfo","fixed_in":["0:0.4.31-7.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc-debuginfo","fixed_in":["0:0.4.31-7.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc-debugsource","fixed_in":["0:0.4.31-7.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc-devel","fixed_in":["0:0.4.31-7.el9_4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"orc","fixed_in":["0:0.4.28-4.el8_10"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"orc","fixed_in":["1:0.4.33-2.root.io.1","1:0.4.33-2.root.io.2","1:0.4.33-2.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-orc","fixed_in":["1:0.4.33-2.root.io.1","1:0.4.33-2.root.io.2","1:0.4.33-2.aikido.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"orc","fixed_in":["0.4.21-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"orc","fixed_in":["0.4.21-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"orc","fixed_in":["0.4.21-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"orc","fixed_in":["0.4.28-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"orc","fixed_in":["0.4.28-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"orc","fixed_in":["0.4.28-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"orc","fixed_in":["0.4.28-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"orc","fixed_in":["0.4.28-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.5","package":"orc","fixed_in":["0.4.28-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"orc","fixed_in":["0.4.28-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"orc","fixed_in":["0.4.28-150000.3.6.1","0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"orc","fixed_in":["0.4.21-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"orc","fixed_in":["0.4.21-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"orc","fixed_in":["0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"orc","fixed_in":["0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"orc","fixed_in":["0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"orc","fixed_in":["0.4.28-150000.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"orc","fixed_in":["0.4.34-2.1","0.4.34-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"orc","fixed_in":["0.4.34-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"orc","fixed_in":["1:0.4.25-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"orc","fixed_in":["1:0.4.28-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"orc","fixed_in":["1:0.4.31-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"orc","fixed_in":["1:0.4.32-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"orc","fixed_in":["1:0.4.38-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"orc","fixed_in":["0.4.39-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.39-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-4.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-4.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-4.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.31-7.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.31-7.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.31-7.el9_4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.31-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.39-2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.26-1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.26-1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.26-1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"orc-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.26-1.el7.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.31-6.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.31-6.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.31-6.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"orc-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.31-6.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.4.33-2","1:0.4.34-1","1:0.4.34-2","1:0.4.34-3","1:0.4.34-3.1~exp1","1:0.4.34-4","1:0.4.34-4.1","1:0.4.34-4.2","1:0.4.34-4.3","1:0.4.38-1","1:0.4.39-1","1:0.4.39-2","1:0.4.39-2+hurd.1","1:0.4.39-3","1:0.4.40-1","1:0.4.41-1","1:0.4.42-1","1:0.4.42-2","1:0.4.42-3","1:0.4.42-4","1:0.4.43-1","1:0.4.43-2","1:0.4.44-1"]},{"source":"osv","ecosystem":"Debian:13","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.39-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.39-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.33-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.34-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.32-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.32-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.31-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.32-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc-compiler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc-compiler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc-compiler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc-compiler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc-compiler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc-compiler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc-compiler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc-compiler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc-compiler-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"orc-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.31-7.el9_4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.28-4.el8_10"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.33-2.root.io.1"},{"fixed":"1:0.4.33-2.root.io.2"},{"fixed":"1:0.4.33-2.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.33-2.root.io.1"},{"fixed":"1:0.4.33-2.root.io.2"},{"fixed":"1:0.4.33-2.aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.21-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.21-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.21-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.21-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.21-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.28-150000.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.34-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.34-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.34-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.25-1ubuntu0.1~esm1"}]}],"versions":["1:0.4.24-1","1:0.4.25-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.28-1ubuntu0.1~esm1"}]}],"versions":["1:0.4.27-1","1:0.4.28-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.31-1ubuntu0.1"}]}],"versions":["1:0.4.30-1","1:0.4.31-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.32-2ubuntu0.1"}]}],"versions":["1:0.4.32-1","1:0.4.32-1build1","1:0.4.32-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.38-1ubuntu0.1"}]}],"versions":["1:0.4.34-3","1:0.4.38-1","1:0.4.38-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.31-1ubuntu0.1"}]}],"versions":["1:0.4.30-1","1:0.4.31-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.32-2ubuntu0.1"}]}],"versions":["1:0.4.32-1","1:0.4.32-1build1","1:0.4.32-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.38-1ubuntu0.1"}]}],"versions":["1:0.4.34-3","1:0.4.38-1","1:0.4.38-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.25-1ubuntu0.1~esm1"}]}],"versions":["1:0.4.24-1","1:0.4.25-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.4.28-1ubuntu0.1~esm1"}]}],"versions":["1:0.4.27-1","1:0.4.28-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"orc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.39-1.1"}]}]}],"products":[{"vendor":"gstreamer","product":"orc"}],"references":[{"url":"https://github.com/GStreamer/orc","tags":["x_transferred","Product","package","article","report"]},{"url":"https://gstreamer.freedesktop.org/modules/orc.html","tags":["x_transferred","Product","web","article","report"]},{"url":"https://jvn.jp/en/jp/JVN02030803/","tags":["x_transferred","Third Party Advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/26/1","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40897","tags":["web","advisory"]},{"url":"https://jvn.jp/en/jp/JVN02030803"},{"url":"https://github.com/advisories/GHSA-247v-6wr5-3wf3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-40897","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5306","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-40897","tags":["report"]},{"url":"https://bugzilla.redhat.com/2300010","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-5306.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6184","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-6184.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1725650489.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1755114348.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40897.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-40897","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0288.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33529","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6964-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1975","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2300010","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5306.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-40897","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5629","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5629.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5638","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5638.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5882","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5882.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6159","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6159.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6184.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:5306","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242643-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228184","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40897","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242663-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250314-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250344-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520060-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520152-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520272-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-40897","tags":["report"]},{"url":"https://gstreamer.freedesktop.org/security/sa-2024-0003.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6964-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-40897","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.","status":"published","published":"2024-07-26T06:03:23.768Z","modified":"2025-02-13T17:53:28.546Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2024-38708","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.","status":"published","published":"2024-07-26T06:03:23Z","modified":"2025-02-13T17:53:28Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:31.305109Z"}],"ghsa":[{"id":"GHSA-247v-6wr5-3wf3","title":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39....","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.","status":"published","published":"2024-07-26T06:30:48Z","modified":"2024-08-27T15:33:06Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:58:05.579928Z"}],"nvd":[{"id":"CVE-2024-40897","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.","status":"published","published":"2024-07-26T06:15:02.29Z","modified":"2026-06-17T07:46:48.887Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787","CWE-121"],"updated_at":"2026-11-02T14:10:14.437386Z"}],"osv":[{"id":"ALPINE-CVE-2024-40897","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.","status":"published","published":"2024-07-26T06:15:02.29Z","modified":"2026-11-02T11:17:50.104907486Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-47050","title":"CVE-2024-40897 affecting package orc 0.4.31-4","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.","status":"published","published":"2024-07-26T06:15:02Z","modified":"2026-04-21T04:32:48.199918Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"AZL-47122","title":"CVE-2024-40897 affecting package orc for versions less than 0.4.39-2","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.","status":"published","published":"2024-07-26T06:15:02Z","modified":"2026-04-21T04:54:00.765504Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"CVE-2024-40897","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.","status":"published","published":"2024-07-26T06:03:23.768Z","modified":"2026-10-28T02:30:46.183785357Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"DEBIAN-CVE-2024-40897","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.","status":"published","published":"2024-07-26T06:15:02.29Z","modified":"2026-11-02T12:02:38.109721825Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"OESA-2024-1975","title":"orc security update","description":"Orc is the sucessor to Liboil - The Library of Optimized Inner Loops. Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data.  The \u0026quot;language\u0026quot; is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.\n\nSecurity Fix(es):\n\nStack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer\u0026apos;s build environment. This may lead to compromise of developer machines or CI build environments.(CVE-2024-40897)","status":"published","published":"2024-08-09T11:07:27Z","modified":"2026-08-18T01:18:32.854873966Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2024:5306","title":"Red Hat Security Advisory: orc security update","status":"published","published":"2024-09-16T20:50:16Z","modified":"2026-03-18T11:31:27.215724Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5629","title":"Red Hat Security Advisory: orc security update","status":"published","published":"2024-09-16T20:50:25Z","modified":"2026-03-18T11:31:34.407364Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5638","title":"Red Hat Security Advisory: orc:0.4.31 security update","status":"published","published":"2024-09-16T20:50:34Z","modified":"2026-03-18T11:31:37.756953Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:5882","title":"Red Hat Security Advisory: orc:0.4.28 security update","status":"published","published":"2024-09-16T20:50:42Z","modified":"2026-03-18T11:31:39.170062Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:6159","title":"Red Hat Security Advisory: orc security update","status":"published","published":"2024-09-16T20:50:59Z","modified":"2026-03-18T11:35:27.067948Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:6184","title":"Red Hat Security Advisory: orc security update","status":"published","published":"2024-09-16T20:50:50Z","modified":"2026-03-18T11:35:25.666205Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RLSA-2024:5306","title":"Moderate: orc security update","description":"Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data.  The \"language\" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.\n\nSecurity Fix(es):\n\n* orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-05-07T20:08:47.83082Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-40897","title":"CVE-2024-40897 in orc - Patched by Root","description":"Root has patched CVE-2024-40897 in the orc package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T12:10:41Z","modified":"2026-08-26T01:12:44.290279798Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"UBUNTU-CVE-2024-40897","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.","status":"published","published":"2024-07-26T06:15:00Z","modified":"2026-04-22T14:59:02.929707Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:54.69008Z"},{"id":"ALSA-2024:5306","title":"Moderate: orc security update","description":"Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data.  The \"language\" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.\n\nSecurity Fix(es):\n\n* orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-08-13T00:00:00Z","modified":"2026-10-29T11:02:21.60947745Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:6184","title":"Moderate: orc security update","description":"Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data.  The \"language\" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.\n\nSecurity Fix(es):\n\n* orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-03T00:00:00Z","modified":"2026-10-29T11:32:05.191617556Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2024-1725650489","title":"orc: Fix of CVE-2024-40897","description":"- CVE-2024-40897: fix stack buffer overflow while construct error messages\n- Disable gtk-doc building due lack of gtkdoc-mktmpl command in gtk-doc-1.28-2.el7","status":"published","published":"2024-09-06T19:21:33Z","modified":"2026-06-01T00:33:17.951037745Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1755114348","title":"orc: Fix of CVE-2024-40897","description":"- CVE-2024-40897: use vasprintf() if available for error messages and otherwise\n  vsnprintf() to allocate as much memory as required and avoid buffer overflow","status":"published","published":"2025-08-13T19:45:52Z","modified":"2026-06-01T00:31:09.604081453Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"MGASA-2024-0288","title":"Updated orc packages fix security vulnerability","description":"Stack-based buffer overflow vulnerability exists in orcparse.c of ORC\nversions prior to 0.4.39. If a developer is tricked to process a\nspecially crafted file with the affected ORC compiler, an arbitrary code\nmay be executed on the developer's build environment. This may lead to\ncompromise of developer machines or CI build environments.\n(CVE-2024-40897)\n","status":"published","published":"2024-09-10T16:40:31Z","modified":"2026-04-16T04:41:57.505552332Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14216-1","title":"liborc-0_4-0-0.4.39-1.1 on GA media","description":"These are all security issues fixed in the liborc-0_4-0-0.4.39-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-24T00:00:00Z","modified":"2026-02-04T03:54:48.837906Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:2643-1","title":"Security update for orc","description":"This update for orc fixes the following issues:\n\n- CVE-2024-40897: Fixed stack-based buffer overflow in the orc compiler when formatting error messages for certain input files (bsc#1228184)\n","status":"published","published":"2024-07-30T08:05:06Z","modified":"2026-02-04T04:19:15.037135Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2663-1","title":"Security update for orc","description":"This update for orc fixes the following issues:\n\n- CVE-2024-40897: Fixed stack-based buffer overflow in the orc compiler when formatting error messages for certain input files (bsc#1228184)\n","status":"published","published":"2024-07-30T13:44:39Z","modified":"2026-02-04T04:21:55.741896Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2025:0314-1","title":"Security update for orc","description":"This update for orc fixes the following issues:\n\n- CVE-2024-40897: Fixed stack-based buffer overflow in the Orc compiler when\n  formatting error messages for certain input files (bsc#1228184)\n","status":"published","published":"2025-01-31T16:03:44Z","modified":"2025-05-02T04:36:57.889883Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:0344-1","title":"Security update for orc","description":"This update for orc fixes the following issues:\n\n- CVE-2024-40897: Fixed stack-based buffer overflow in the Orc compiler when\n  formatting error messages for certain input files (bsc#1228184)\n","status":"published","published":"2025-02-03T17:05:17Z","modified":"2026-02-04T04:31:37.991695Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20060-1","title":"Security update for orc","description":"This update for orc fixes the following issues:\n\n- CVE-2024-40897: Fixed a stack-based buffer overflow when formatting error messages (bsc#1228184)\n","status":"published","published":"2025-02-03T08:57:48Z","modified":"2026-03-23T04:48:08.738356Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20152-1","title":"Security update for orc","description":"This update for orc fixes the following issues:\n\n- CVE-2024-40897: Fixed a stack-based buffer overflow in the Orc compiler when formatting error messages for certain input files (bsc#1228184)\n","status":"published","published":"2025-03-19T10:36:26Z","modified":"2026-03-23T04:50:42.219433Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20272-1","title":"Security update for orc","description":"This update for orc fixes the following issues:\n\n- CVE-2024-40897: Fixed stack-based buffer overflow inside the orc compiler when formatting error messages for certain input files (bsc#1228184).\n","status":"published","published":"2025-04-22T12:08:14Z","modified":"2026-03-23T04:48:55.421583Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-6964-1","title":"orc vulnerability","description":"Noriko Totsuka discovered that ORC incorrectly handled certain\ncrafted file. An attacker could possibly use this issue to execute\narbitrary code.\n","status":"published","published":"2024-08-15T19:00:10Z","modified":"2026-04-22T10:50:44.033607Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-6964-2","title":"orc vulnerability","description":"USN-6964-1 fixed a vulnerability in ORC. This update provides the\ncorresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n\nOriginal advisory details:\n\n Noriko Totsuka discovered that ORC incorrectly handled certain\n specially crafted files. An attacker could possibly use this issue\n to execute arbitrary code.\n","status":"published","published":"2024-10-01T11:11:43Z","modified":"2026-06-25T13:32:28.604874518Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}