{"id":"CVE-2024-42415","aliases":["AZL-50061","AZL-50088","DEBIAN-CVE-2024-42415","DLA-3911-1","DSA-5786-1","EUVD-2024-39610","GHSA-5pmr-hjgq-832v","MGASA-2024-0337","OESA-2024-2221","SUSE-SU-2024:3770-1","SUSE-SU-2024:3920-1","SUSE-SU-2024:3921-1","SUSE-SU-2024:3922-1","UBUNTU-CVE-2024-42415","USN-7062-1"],"status":"published","title":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1...","description":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00458,"percentile":0.40009,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2024-10-03T15:24:57Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:12","package":"libgsf","fixed_in":["1.14.50-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgsf","fixed_in":["1.14.52-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgsf","fixed_in":["1.14.52-1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libgsf","fixed_in":["1.14.46-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libgsf","fixed_in":["1.14.47-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libgsf","fixed_in":["1.14.51-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.47-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.14.47-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.50-1+deb12u1"}]}],"versions":["1.14.50-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.52-1.1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.47-1+deb11u1"}]}],"versions":["1.14.47-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.50-1+deb12u1"}]}],"versions":["1.14.50-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.50-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.47-2.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.43-6.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.47-2.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.50-2.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.47-2.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.40-8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.40-8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.51-150600.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP6","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.51-150600.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.51-150600.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.46-150200.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.46-150200.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.46-150200.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.46-150200.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.46-150200.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.46-150200.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.46-150200.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.50-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.50-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.50-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.50-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.50-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.50-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.50-150400.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.27-2ubuntu1","1.14.27-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.34-1","1.14.34-2","1.14.35-1","1.14.36-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.41-1","1.14.41-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.46-1ubuntu0.1"}]}],"versions":["1.14.46-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.47-1ubuntu0.1"}]}],"versions":["1.14.47-1build1","1.14.47-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.51-2ubuntu0.1"}]}],"versions":["1.14.50-1","1.14.51-1","1.14.51-2","1.14.51-2build1","1.14.51-2build2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.46-1ubuntu0.1"}]}],"versions":["1.14.46-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.47-1ubuntu0.1"}]}],"versions":["1.14.47-1build1","1.14.47-1build2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.51-2ubuntu0.1"}]}],"versions":["1.14.50-1","1.14.51-1","1.14.51-2","1.14.51-2build1","1.14.51-2build2"],"bundled":2}],"products":[{"vendor":"gnome","product":"libgsf"},{"vendor":"gnome project","product":"g structured file library (libgsf)"}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2024-2069","tags":["Technical Description","Third Party Advisory","web","report"]},{"url":"https://gitlab.gnome.org/GNOME/libgsf/-/issues/34","tags":["Issue Tracking","report"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2069","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/10/04/3","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00002.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42415","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5pmr-hjgq-832v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42415.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-42415","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0337.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33620","tags":["report"]},{"url":"https://lwn.net/Articles/993121/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-7062-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36474","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243770-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1014609","tags":["report"]},{"url":"https://bugzilla.suse.com/1231282","tags":["report"]},{"url":"https://bugzilla.suse.com/1231283","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42415","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243920-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243921-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243922-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-42415","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42415","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7062-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-36474","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-42415","description":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2024-10-03T15:24:57.874Z","modified":"2025-11-03T22:04:50.389Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:34:02.652467Z"}],"euvd":[{"id":"EUVD-2024-39610","description":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2024-10-03T15:24:57Z","modified":"2025-11-03T22:04:50Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"ghsa":[{"id":"GHSA-5pmr-hjgq-832v","title":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1...","description":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2024-10-03T18:30:36Z","modified":"2025-11-04T00:31:34Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:04:28.385807Z"}],"nvd":[{"id":"CVE-2024-42415","description":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2024-10-03T16:15:05.867Z","modified":"2026-06-17T07:49:24.883Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:10:30.673028Z"}],"osv":[{"id":"AZL-50061","title":"CVE-2024-42415 affecting package libgsf 1.14.47-2","description":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2024-10-03T16:15:05Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.514083Z"},{"id":"AZL-50088","title":"CVE-2024-42415 affecting package libgsf 1.14.47-2","description":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2024-10-03T16:15:05Z","modified":"2026-04-21T04:30:06.758864Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"CVE-2024-42415","description":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2024-10-03T15:24:57.874Z","modified":"2026-10-28T02:30:42.125607316Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"DEBIAN-CVE-2024-42415","description":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2024-10-03T16:15:05.867Z","modified":"2026-11-02T12:02:47.089841077Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"OESA-2024-2221","title":"libgsf security update","description":"The libgsf library is an extensible I/O abstraction library for dealing with structured file formats.\r\n\r\nSecurity Fix(es):\r\n\r\nAn integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-bounds index to be used when reading and writing to an array. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.(CVE-2024-36474)\r\n\r\nAn integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.(CVE-2024-42415)","status":"published","published":"2024-10-12T11:07:41Z","modified":"2026-08-18T01:17:34.235104264Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2024-42415","description":"An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocation table. This can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2024-10-03T16:15:00Z","modified":"2026-04-22T15:04:39.63385Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"DLA-3911-1","title":"libgsf - security update","status":"published","published":"2024-10-07T00:00:00Z","modified":"2026-03-09T01:21:51.590763Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5786-1","title":"libgsf - security update","status":"published","published":"2024-10-05T00:00:00Z","modified":"2026-03-09T02:11:41.343655Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0337","title":"Updated libgsf packages fix security vulnerabilities","description":"An integer overflow vulnerability exists in the Compound Document Binary\nFile format parser of the GNOME Project G Structured File Library\n(libgsf) version v1.14.52. A specially crafted file can result in an\ninteger overflow when processing the directory from the file that allows\nfor an out-of-bounds index to be used when reading and writing to an\narray. This can lead to arbitrary code execution. An attacker can\nprovide a malicious file to trigger this vulnerability. (CVE-2024-36474)\nAn integer overflow vulnerability exists in the Compound Document Binary\nFile format parser of v1.14.52 of the GNOME Project G Structured File\nLibrary (libgsf). A specially crafted file can result in an integer\noverflow that allows for a heap-based buffer overflow when processing\nthe sector allocation table. This can lead to arbitrary code execution.\nAn attacker can provide a malicious file to trigger this vulnerability.\n(CVE-2024-42415)\n","status":"published","published":"2024-10-27T02:37:06Z","modified":"2026-04-16T04:40:53.64933667Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"SUSE-SU-2024:3770-1","title":"Security update for libgsf","description":"This update for libgsf fixes the following issues:\n\n- CVE-2016-9888: Fixed null pointer dereference with corrupted tar files (bsc#1014609)\n- CVE-2024-36474: Fixed out-of-bounds index when processing a directory via an integer overflow in the compound document binary file format parser (bsc#1231282)\n- CVE-2024-42415: Fixed heap-based buffer overflow when processing the sector allocation table via an integer overflow in the compound document binary file format parser (bsc#1231283)\n","status":"published","published":"2024-10-29T12:55:13Z","modified":"2025-05-02T04:29:42.720648Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3920-1","title":"Security update for libgsf","description":"This update for libgsf fixes the following issues:\n\n- CVE-2024-42415, CVE-2024-36474: Fixed integer overflows affecting memory allocation (bsc#1231282, bsc#1231283).\n","status":"published","published":"2024-11-06T10:11:23Z","modified":"2026-02-04T03:09:03.84332Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3921-1","title":"Security update for libgsf","description":"This update for libgsf fixes the following issues:\n\n- CVE-2024-42415, CVE-2024-36474: Fixed integer overflows affecting memory allocation (bsc#1231282, bsc#1231283).\n","status":"published","published":"2024-11-06T10:11:55Z","modified":"2026-02-04T03:32:23.582038Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3922-1","title":"Security update for libgsf","description":"This update for libgsf fixes the following issues:\n\n- CVE-2024-42415, CVE-2024-36474: Fixed integer overflows affecting memory allocation (bsc#1231282, bsc#1231283).\n","status":"published","published":"2024-11-06T10:12:18Z","modified":"2026-02-04T03:20:43.705026Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-7062-1","title":"libgsf vulnerabilities","description":"It was discovered that libgsf incorrectly handled certain Compound Document\nBinary files. If a user or automated system were tricked into opening\na specially crafted file, a remote attacker could possibly use this issue\nto execute arbitrary code.\n","status":"published","published":"2024-10-10T12:06:46Z","modified":"2026-04-27T17:31:20.862348Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}