CVE-2024-42415
MediumSummary
An integer overflow vulnerability exists in the Compound Document Binary File format parser of libgsf version v1.14.52. A specially crafted file can cause an integer overflow, leading to a heap-based buffer overflow when processing sector allocation.
Risk Assessment
A remote attacker can supply a crafted file, causing a heap buffer overflow, potentially allowing arbitrary code execution or application crash.
Recommendation
Update libgsf to a version that fixes the integer overflow and subsequent heap buffer overflow.
Original NVD description (English source)
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). A specially crafted file can result in an integer overflow that allows for a heap-based buffer overflow when processing the sector allocati