Log in Start free

Vulnerability · Published Feb 6, 2024 · Assigned by fedora

CVE-2024-0911Indent: heap-based buffer overflow in set_buf_break()

Medium 5.5

In plain English

A medium-severity heap buffer overflow in indent. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.3%top 75.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in indent, a program for formatting C code. This issue may allow an attacker to trick a user into processing a specially crafted file to trigger a heap-based buffer overflow, causing the application to crash.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12indent2.2.12-4+deb12u3DEBIAN-CVE-2024-0911
Debian:13indent2.2.13-4DEBIAN-CVE-2024-0911
Debian:14indent2.2.13-4DEBIAN-CVE-2024-0911
Ubuntu:22.04:LTSindentno fix listedUBUNTU-CVE-2024-0911

Affected products (as reported)

VendorProductVersions
indent 2.2.13

Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References