CVE-2024-1013 Unixodbc: out of bounds stack write due to pointer-to-integer types conversion
HighCVSS 7.8
EPSS 0.28%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/unixodbc(Debian:12) | All versions | No fix listed |
| debian/unixodbc(Debian:12) | = 2.3.11-2 | No fix listed |
| debian/unixodbc(Debian:12) | = 2.3.11-2+deb12u1 | No fix listed |
| debian/unixodbc(Debian:12) | = 2.3.11-3 | No fix listed |
| debian/unixodbc(Debian:12) | = 2.3.11-4 | No fix listed |
| debian/unixodbc(Debian:12) | = 2.3.12-1 | No fix listed |
| debian/unixodbc(Debian:12) | = 2.3.12-2 | No fix listed |
| debian/unixodbc(Debian:12) | = 2.3.14-1 | No fix listed |
| debian/unixodbc(Debian:12) | = 2.3.14-2 | No fix listed |
| debian/unixodbc(Debian:13) | All versions | No fix listed |
| debian/unixodbc(Debian:13) | = 2.3.12-2 | No fix listed |
| debian/unixodbc(Debian:13) | = 2.3.12-2+deb13u1 | No fix listed |
| debian/unixodbc(Debian:13) | = 2.3.14-1 | No fix listed |
| debian/unixodbc(Debian:13) | = 2.3.14-2 | No fix listed |
| debian/unixodbc(Debian:14) | < 2.3.14-1 | 2.3.14-1 |
| debian/unixodbc(Debian:14) | = 2.3.12-2 | No fix listed |
| ubuntu/unixodbc(Ubuntu:22.04) | < 2.3.9-5ubuntu0.1 | 2.3.9-5ubuntu0.1 |
| redhat rhel els | = 6 | No fix listed |
| redhat rhel els | = 7 | No fix listed |
| redhat enterprise linux | = 8 | No fix listed |
| redhat enterprise linux | = 9 | No fix listed |
| ubuntu/unixodbc(Ubuntu:24.04) | < 2.3.12-1ubuntu0.24.04.1 | 2.3.12-1ubuntu0.24.04.1 |
| unixodbc | All versions | No fix listed |
References
- Debian Security Tracker CVE-2024-1013 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-6715-1 vendor-advisory
- USN-6715-2 vendor-advisory
- www.cve.org
- access.redhat.com broken-link vdb-entry
- RHBZ#2260823 issue-tracking
- github.com issue-tracking