Vulnerability · Published Aug 29, 2024 · Assigned by jpcert
CVE-2024-43700
High 7.0
In plain English
A high-severity buffer overflow in xfpt from Philip Hazel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow vulnerability. When a user of the affected product is tricked to process a specially crafted file, arbitrary code may be executed on the user's environment.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | xfpt | 0.11-1+deb12u1 | DEBIAN-CVE-2024-43700 |
| Debian:13 | xfpt | 1.00-3 | DEBIAN-CVE-2024-43700 |
| Debian:14 | xfpt | 1.00-3 | DEBIAN-CVE-2024-43700 |
| Ubuntu:22.04:LTS | xfpt | 0.11-1ubuntu0.1 | USN-7192-1 |
| Ubuntu:22.04:LTS | xfpt | 0.11-1ubuntu0.1 | UBUNTU-CVE-2024-43700 |
| Ubuntu:24.04:LTS | xfpt | 1.00-2ubuntu0.24.04.1 | UBUNTU-CVE-2024-43700 |
| Ubuntu:24.04:LTS | xfpt | 1.00-2ubuntu0.24.04.1 | USN-7192-1 |
| Ubuntu:25.10 | xfpt | no fix listed | UBUNTU-CVE-2024-43700 |
| Ubuntu:26.04:LTS | xfpt | no fix listed | UBUNTU-CVE-2024-43700 |
| Ubuntu:26.10 | xfpt | no fix listed | UBUNTU-CVE-2024-43700 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Philip Hazel | xfpt | prior to 1.01 |
Weakness: CWE-120 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H