Back

CVE-2024-47611

Oct. 2, 2024, 4:35 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

XZ Utils

  • 5.6.2
  • older

Source

security-advisories@github.com

Tags

security-advisories@github.com
CWE-176
2024-10-02
CVE-2024-47611

CVE-2024-47611 details

Published : Oct. 2, 2024, 3:15 p.m.
Last Modified : Oct. 2, 2024, 4:35 p.m.

Description

XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. If a command line contains Unicode characters (for example, filenames) that don't exist in the current legacy code page, the characters are converted to similar-looking characters with best-fit mapping. Some best-fit mappings result in ASCII characters that change the meaning of the command line, which can be exploited with malicious filenames to do argument injection or directory traversal attacks. This vulnerability is fixed in 5.6.3. Command line tools built for Cygwin or MSYS2 are unaffected. liblzma is unaffected.

CVSS Score

1 2 3 4 5 6 7 8 9 10

Weakness

Weakness Name Description
CWE-176 Improper Handling of Unicode Encoding The product does not properly handle when an input contains Unicode encoding.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

NONE

Base Score

0.0

Exploitability Score

3.9

Impact Score

0.0

Base Severity

NONE

Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

References

URL Source
https://github.com/tukaani-project/xz/commit/bf518b9ba446327a062ddfe67e7e0a5baed2394f security-advisories@github.com
https://github.com/tukaani-project/xz/security/advisories/GHSA-m538-c5qw-3cg4 security-advisories@github.com
This website uses the NVD API, but is not approved or certified by it.