Vulnerability Details : CVE-2024-2961

Public exploit exists!
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.
Published 2024-04-17 18:15:16
Updated 2025-02-13 18:17:58
Source glibc
View at NVD,   CVE.org

Products affected by CVE-2024-2961

Please log in to view affected product information.

Exploit prediction scoring system (EPSS) score for CVE-2024-2961

EPSS FAQ
93.53%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2024-2961

  • CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() funct
    Disclosure Date: 2024-07-26
    First seen: 2024-10-19
    exploit/linux/http/magento_xxe_to_glibc_buf_overflow
    This combination of an Arbitrary File Read (CVE-2024-34102) and a Buffer Overflow in glibc (CVE-2024-2961) allows for unauthenticated Remote Code Execution on the following versions of Magento and Adobe Commerce and earlier if the PHP and glibc versions are also vulner

CVSS scores for CVE-2024-2961

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.3
 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
2.5
4.7
 134c704f-9b21-4f2e-91b3-4a467353bcc0 2024-07-03

CWE ids for CVE-2024-2961

  • The product writes data past the end, or before the beginning, of the intended buffer.
    Assigned by: 3ff69d7a-14f2-4f67-a097-88dee7810d18 (Secondary)

References for CVE-2024-2961

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close