EUVD-2024-54622Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.
AnalysisAI
Integer underflow vulnerability in catdoc 0.95's OLE Document DIFAT (Double-Indirect File Allocation Table) Parser that enables heap-based memory corruption through specially crafted malformed files. An attacker can exploit this local vulnerability (no privileges required) by providing a malicious OLE document to trigger the integer underflow, potentially achieving arbitrary code execution or denial of service. While no active KEV status or widespread POC is confirmed in this dataset, the CVSS 8.4 score and high impact ratings (confidentiality, integrity, availability all marked 'H') indicate this is a critical local code execution risk for users who process untrusted OLE documents.
Technical ContextAI
The vulnerability exists in catdoc's implementation of the OLE Compound Document Format parser, specifically in DIFAT (Double-Indirect FAT) sector chain processing. The DIFAT structure is a critical component of OLE file format used by Microsoft Office legacy documents and other applications. The integer underflow (CWE-191) occurs when parsing sector counts or offsets in DIFAT chains—likely during size calculations where an attacker-controlled value is subtracted from another, causing the result to wrap around to a large positive value. This leads to out-of-bounds heap memory access when the parser allocates or reads buffers based on the underflowed value. Catdoc is a utility designed to extract text from OLE documents (primarily Microsoft Office .doc files), making it a target for document processing pipelines. Affected CPE likely includes: cpe:2.3:a:vova:catdoc:0.95:*:*:*:*:*:*:* (and potentially earlier versions depending on when the vulnerability was introduced).
CVE-2024-52035 is an integer overflow vulnerability in catdoc 0.95's OLE Document File Allocation Table (FAT) parser tha
Catdoc v0.95 was discovered to contain a global buffer overflow via the function process_file at /src/reader.c. Rated hi
The ole_init function in ole.c in catdoc 0.95 allows remote attackers to cause a denial of service (heap-based buffer un
Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c. Rated hig
Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c. Rated med
Same weakness CWE-191 – Integer Underflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| upstream | needs-triage | - |
| oracular | ignored | end of life, was needs-triage |
| plucky | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
Debian
Bug #1107168| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 1:0.95-4.1+deb11u1 | - |
| bullseye (security) | fixed | 1:0.95-4.1+deb11u1 | - |
| bookworm, bookworm (security) | fixed | 1:0.95-6~deb12u1 | - |
| forky, sid, trixie | fixed | 1:0.95-6 | - |
| bookworm | fixed | 1:0.95-6~deb12u1 | - |
| (unstable) | fixed | 1:0.95-6 | - |
Share
External POC / Exploit Code
Leaving vuln.today