CVE-2024-58392: falha de média gravidade em icculus PhysicsFS
PhysicsFS through 3.2.0 Out-of-Bounds Read via __PHYSFS_utf8codepoint
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.2%
PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. Attackers can supply a crafted archive with entry names ending in six-octet sequences, causing PHYSFS_utf8stricmp() and hashing to over-read and crash the application.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
icculus · PhysicsFSReferências
https://github.com/icculus/physfs/blob/release-3.2.0/src/physfs_unicode.c#L165-L187https://github.com/icculus/physfs/commit/8a90802778f14dea9c086fb5436839181a3222d5https://github.com/icculus/physfs/issues/79https://hackmd.io/@haind-pwn/physfs-utf8-decoder-overreadhttps://www.vulncheck.com/advisories/physicsfs-through-3.2.0-out-of-bounds-read-via-physfs-utf8codepoint