Integer underflow in Raptor RDF Syntax Library - CVE-2024-57823

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU102758

Integer underflow in Raptor RDF Syntax Library - CVE-2024-57823

Published: January 15, 2025


Vulnerability identifier: #VU102758
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-57823
CWE-ID: CWE-191
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer underflow when handling URIs in PDF files. A remote attacker can pass specially crafted data to the application, trigger an integer underflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

Raptor RDF Syntax Library
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libraptor2-0 (Ubuntu package)
raptor2-utils (Ubuntu package)
raptor2-devel
raptor2
raptor2 (Red Hat package)
raptor2-doc
raptor2-debuginfo
raptor2-debugsource
raptor2-help
libraptor2-0-debuginfo
libraptor2-0-32bit
libraptor2-0-32bit-debuginfo
raptor-debugsource
raptor-debuginfo
libraptor2-0
libraptor-devel
raptor
raptor2 (Ubuntu package)
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Desktop Applications Module
openSUSE Leap
Ubuntu
openEuler

How to mitigate CVE-2024-57823

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

libraptor2-0 (Ubuntu package) - addressed in versions 2.0.15-0ubuntu1.20.04.2, 2.0.15-0ubuntu4.1, 2.0.16-3ubuntu0.1, 2.0.16-4ubuntu0.1
raptor2-utils (Ubuntu package) - addressed in versions 2.0.15-0ubuntu1.20.04.2, 2.0.15-0ubuntu4.1, 2.0.16-3ubuntu0.1, 2.0.16-4ubuntu0.1
raptor2-devel - addressed in versions 2.0.9-5, 2.0.15-17.0.1
raptor2 - addressed in versions 2.0.9-5, 2.0.15-17.0.1
raptor2 (Red Hat package) - addressed in versions 2.0.9-5.el7_9, 2.0.15-17.el8_2, 2.0.15-17.el8_4, 2.0.15-17.el8_6, 2.0.15-17.el8_8, 2.0.15-17.el8_10, 2.0.15-31.el9_0, 2.0.15-31.el9_2, 2.0.15-31.el9_4, 2.0.15-32.el9_5
raptor2-doc - update to 2.0.15-17.0.1
raptor2-debuginfo - update to 2.0.15-20
raptor2 - update to 2.0.15-20
raptor2-debugsource - update to 2.0.15-20
raptor2-devel - update to 2.0.15-20
raptor2-help - update to 2.0.15-20
libraptor2-0-debuginfo - update to 2.0.15-150200.9.18.1
libraptor2-0-32bit - update to 2.0.15-150200.9.18.1
libraptor2-0-32bit-debuginfo - update to 2.0.15-150200.9.18.1
raptor-debugsource - update to 2.0.15-150200.9.18.1
raptor-debuginfo - update to 2.0.15-150200.9.18.1
libraptor2-0 - update to 2.0.15-150200.9.18.1
libraptor-devel - update to 2.0.15-150200.9.18.1
raptor - update to 2.0.15-150200.9.18.1
raptor2 (Ubuntu package) - addressed in versions 2.0.14-1ubuntu0.16.04.1+esm1, 2.0.14-1ubuntu0.18.04.1+esm1

External References

Related Security Bulletins