CVE-2024-10397
CVE-2024-10397 · Preallocated buffer overflows in XDR responses
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A malicious server can crash the OpenAFS cache manager and other client utilities, and possibly execute arbitrary code.
CVSS 7.7 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
openafs
- Versions
- ≥ 1.0, < 1.6.24: Affected (semver)
- ≥ 1.8.0, < 1.8.12.2: Affected (semver)
- ≥ 1.9.0, < 1.9.1: Affected (semver)
Update to 1.6.24; Update to 1.8.12.2; Update to 1.9.1
openafs Debian:12
- Versions
- 1.8.9-1
- Affected ranges
- ECOSYSTEM: < 1.8.9-1+deb12u1
Update to 1.8.9-1+deb12u1
openafs Debian:13
- Affected ranges
- ECOSYSTEM: < 1.8.13-1
Update to 1.8.13-1
openafs Ubuntu:16.04:LTS
- Versions
- 1.6.14-1
- 1.6.15-1
- 1.6.15-1ubuntu1
- 1.6.15-1ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openafs Ubuntu:18.04:LTS
- Versions
- 1.6.21-3
- 1.6.21-3ubuntu1
- 1.6.22-3
- 1.8.0~pre4-1
- 1.8.0~pre5-1
- 1.8.0~pre5-1ubuntu1
- 1.8.0~pre5-1ubuntu1.1
- 1.8.0~pre5-1ubuntu1.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openafs Ubuntu:20.04:LTS
- Versions
- 1.8.4~pre1-1ubuntu2
- 1.8.4~pre1-1ubuntu2.1
- 1.8.4~pre1-1ubuntu2.2
- 1.8.4~pre1-1ubuntu2.3
- 1.8.4~pre1-1ubuntu2.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openafs Ubuntu:22.04:LTS
- Versions
- 1.8.6-5ubuntu2
- 1.8.8-3
- 1.8.8.1-1
- 1.8.8.1-3ubuntu2~22.04.1
- 1.8.8.1-3ubuntu2~22.04.2
- 1.8.10-2ubuntu1~22.04.1
- 1.8.10-2ubuntu1~22.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
openafs Ubuntu:24.04:LTS
- Versions
- 1.8.10-1ubuntu2
- 1.8.10-1ubuntu3
- 1.8.10-1ubuntu4
- 1.8.10-1ubuntu6
- 1.8.10-2ubuntu1
- 1.8.10-2.1ubuntu1
- 1.8.10-2.1ubuntu2
- 1.8.10-2.1ubuntu3
- 1.8.10-2.1ubuntu3.1
- 1.8.10-2.1ubuntu3.2
- 1.8.10-2.1ubuntu3.3
- 1.8.10-2.1ubuntu3.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published