Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade orcUpgrade orc-compilerUpgrade orc-devel | Aug 22, 2024 | Jul 26, 2024 |
| Alpine Linux | — | Upgrade orc | Oct 1, 2024 | Jul 26, 2024 |
| Amazon Linux Ami 2 | — | Upgrade orcUpgrade orc-docUpgrade orc-debuginfoUpgrade orc-compilerUpgrade orc-devel | Jan 10, 2025 | Jul 26, 2024 |
| Amazon_linux_2023 | — | Upgrade orc-develUpgrade orcUpgrade orc-compiler-debuginfoUpgrade orc-docUpgrade orc-debuginfoUpgrade orc-compilerUpgrade orc-debugsource | Feb 17, 2025 | Jul 26, 2024 |
| Debian | — | Upgrade orc | May 15, 2025 | Jul 26, 2024 |
| Gentoo Linux | — | Upgrade dev-lang/orc. | May 13, 2025 | Jul 26, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade orc-helpUpgrade orc | Oct 8, 2024 | Jul 26, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade orcUpgrade orc-help | Oct 9, 2024 | Jul 26, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade orc-helpUpgrade orc | Nov 5, 2024 | Jul 26, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade orc-helpUpgrade orc | Oct 8, 2024 | Jul 26, 2024 |
| Oracle_linux | — | Upgrade orc-develUpgrade orcUpgrade orc-compiler | Oct 16, 2024 | Jul 26, 2024 |
| Redhat_linux | — | No solution existsUpgrade orc-compiler-debuginfoUpgrade orc-compilerUpgrade orc-debuginfoUpgrade orc-debugsourceUpgrade orc-develUpgrade orc | Sep 13, 2024 | Jul 26, 2024 |
| Rocky_linux | — | Upgrade orc-debugsourceUpgrade orc-debuginfoUpgrade orc-compilerUpgrade orc-develUpgrade orcUpgrade orc-compiler-debuginfo | May 8, 2025 | Jul 26, 2024 |
| Suse | — | Upgrade orcUpgrade orc-docUpgrade liborc-0_4-0-32bitUpgrade liborc-0_4-0 | Jul 31, 2024 | Jul 26, 2024 |
| Ubuntu | — | Upgrade liborc-0.4-0Upgrade liborc-0.4-dev (Ubuntu Pro)Upgrade liborc-0.4-0t64Upgrade liborc-0.4-0 (Ubuntu Pro) | Aug 19, 2024 | Jul 26, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub