Libgsf
Monthly
Heap-based buffer overflow in the OLE2 parser of GNOME libgsf (function ole_info_read_metabat in gsf/gsf-infile-msole.c) affects versions up to 1.14.60 and allows remote attackers to corrupt heap memory when a victim opens, previews, or otherwise processes a crafted OLE2 compound document with an application that relies on the library. The required user interaction (UI:P) prevents a fully unattended trigger, and the assessed impact is limited to low confidentiality, integrity and availability effects rather than confirmed code execution. No public exploit identified at time of analysis; an upstream fix commit has been published, and the issue fits a routine monthly patch cycle rather than an emergency response.
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
Heap-based buffer overflow in the OLE2 parser of GNOME libgsf (function ole_info_read_metabat in gsf/gsf-infile-msole.c) affects versions up to 1.14.60 and allows remote attackers to corrupt heap memory when a victim opens, previews, or otherwise processes a crafted OLE2 compound document with an application that relies on the library. The required user interaction (UI:P) prevents a fully unattended trigger, and the assessed impact is limited to low confidentiality, integrity and availability effects rather than confirmed code execution. No public exploit identified at time of analysis; an upstream fix commit has been published, and the issue fits a routine monthly patch cycle rather than an emergency response.
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured File Library (libgsf). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (libgsf) version v1.14.52. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.