Vulnerability · Published Jul 29, 2024 · Assigned by jpcert
CVE-2024-41881
High 8.8
In plain English
A high-severity stack buffer overflow in SDoP from Philip Hazel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 52.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SDoP versions prior to 1.11 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted XML file, arbitrary code may be executed on the user's environment.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sdop | no fix listed | DEBIAN-CVE-2024-41881 |
| Debian:13 | sdop | no fix listed | DEBIAN-CVE-2024-41881 |
| Debian:14 | sdop | no fix listed | DEBIAN-CVE-2024-41881 |
| Ubuntu:22.04:LTS | sdop | no fix listed | UBUNTU-CVE-2024-41881 |
| Ubuntu:24.04:LTS | sdop | no fix listed | UBUNTU-CVE-2024-41881 |
| Ubuntu:25.10 | sdop | no fix listed | UBUNTU-CVE-2024-41881 |
| Ubuntu:26.04:LTS | sdop | no fix listed | UBUNTU-CVE-2024-41881 |
| Ubuntu:26.10 | sdop | no fix listed | UBUNTU-CVE-2024-41881 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Philip Hazel | SDoP | prior to 1.11 |
Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H