CVE-2024-42415: Integer Overflow in GNOME libgsf

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2069 reports:

GNOME Project G Structured File Library (libgsf) Compound Document Binary File
 Sector Allocation Table integer overflow vulnerability

October 3, 2024

CVE Number

CVE-2024-42415

SUMMARY

An integer overflow vulnerability exists in the Compound Document Binary File
format parser of v1.14.52 of the GNOME Project G Structured File Library
(libgsf). A specially crafted file can result in an integer overflow that allows
for a heap-based buffer overflow when processing the sector allocation table.
This can lead to arbitrary code execution. An attacker can provide a malicious
file to trigger this vulnerability.

CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or 
confirmed to be vulnerable by the vendor.

GNOME Project G Structured File Library (libgsf) 1.14.52
GNOME Project G Structured File Library (libgsf) commit 
634340d31177c02ccdb43171e37291948e7f8974

PRODUCT URLS

G Structured File Library (libgsf) - https://gitlab.gnome.org/GNOME/libgsf.git

CVSSv3 SCORE

8.4 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A detailed analysis is provided in the report at the above URL.

The upstream bug report is at https://gitlab.gnome.org/GNOME/libgsf/-/issues/34
and states the bug is "Fixed in 1.14.53" and
https://gitlab.gnome.org/GNOME/libgsf/-/commit/06d0cb92a4c02e7126ef2ff6f5e29fd74b4be9e0
says it fixes that issue.

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris